@sweny-ai/core 0.1.142 → 0.1.143

package/dist/harness/codex.js

@@ -0,0 +1,917 @@
+/**
+ * Codex harness (#331): runs a node on OpenAI Codex through `codex exec --json`.
+ *
+ * Interfaces used, all read from openai/codex at rust-v0.159.2:
+ * - `codex-rs/exec/src/cli.rs`: `exec --json`, `--output-schema <file>`,
+ *   `--ignore-user-config`, `--ignore-rules`, `--ephemeral`,
+ *   `--skip-git-repo-check`, `--sandbox`, `--cd`, `--model`, `-c key=value`,
+ *   prompt on stdin with `-`.
+ * - `codex-rs/exec/src/exec_events.rs`: the JSONL events (`thread.started`,
+ *   `turn.started|completed|failed`, `item.started|updated|completed`,
+ *   `error`) and item kinds.
+ * - `sdk/typescript/src/exec.ts`: how the official SDK spawns the same CLI
+ *   (config overrides as TOML values, stdin prompt, exit handling).
+ * - `codex-rs/core/config.schema.json`: `features.*`, `web_search`,
+ *   `agents.enabled`, `sandbox_workspace_write.network_access`,
+ *   `mcp_servers.<id>.{command,args,env,env_vars,url,http_headers,...}`.
+ * - `codex-rs/rmcp-client/src/utils.rs`: an MCP stdio server gets only a
+ *   small default env plus the names listed in `env_vars`, so the tool
+ *   bridge token travels by name, never in argv.
+ *
+ * Every sweny opinion in the Codex column of the enforcement matrix is
+ * enforced natively here, kept by sweny (watchdog, fencing, env scoping,
+ * output validation), reported in `degraded`, or refused under strict policy
+ * by `policyGate`. Nothing is dropped silently.
+ */
+import { spawn, execFile } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { consoleLogger } from "../types.js";
+import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, } from "../agent-env.js";
+import { CODEX_CAPABILITIES } from "./capabilities.js";
+import { policyGate, resolveHarnessPolicy } from "./policy.js";
+import { buildNodePrompt } from "./prompts.js";
+import { makeAbort } from "./abort.js";
+import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
+import { startToolBridge } from "./tool-bridge/server.js";
+import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandbox-wrapper.js";
+import { TOKEN_ENV } from "./tool-bridge/protocol.js";
+export { CODEX_CAPABILITIES };
+/** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
+export const MIN_CODEX_VERSION = "0.159.0";
+/** Same system prompt Claude Code nodes get, sent as Codex developer instructions. */
+const SYSTEM_PROMPT = `You are a step in an automated workflow. Execute the instruction precisely using the tools available to you. Be thorough but concise. When you're done, summarize your findings and results.`;
+/**
+ * Codex features sweny always turns off, so a node sees only the tools sweny
+ * gave it: ChatGPT apps and plugins (their own MCP servers), tool suggestions,
+ * browser and computer use, lifecycle hooks, and image generation. Keys from
+ * `codex-rs/features/src/lib.rs` at rust-v0.159.2.
+ */
+export const CODEX_ISOLATION_FEATURES_OFF = [
+    "apps",
+    "plugins",
+    "tool_suggest",
+    "browser_use",
+    "computer_use",
+    "hooks",
+    "image_generation",
+];
+/**
+ * Built-in tool names a node's `disallowed_tools` may use, per portable class.
+ * Claude Code names are included because bundled workflows (triage.yml) were
+ * written for it; Codex names come from its tool registry.
+ */
+const DENY_NAME_TO_CLASSES = {
+    // Claude Code built-ins
+    Bash: ["shell"],
+    Write: ["write"],
+    NotebookEdit: ["write"],
+    Edit: ["edit"],
+    MultiEdit: ["edit"],
+    WebFetch: ["net"],
+    WebSearch: ["net"],
+    Task: ["subagent"],
+    Agent: ["subagent"],
+    // Codex built-ins
+    shell: ["shell"],
+    exec_command: ["shell"],
+    local_shell: ["shell"],
+    apply_patch: ["write", "edit"],
+    web_search: ["net"],
+    spawn_agent: ["subagent"],
+};
+/**
+ * Hosts Codex itself needs (its model API and ChatGPT sign-in), always allowed
+ * through the sandbox wrapper, plus the host of `OPENAI_BASE_URL` when set.
+ */
+export function codexBackendHosts(env = process.env) {
+    const hosts = ["api.openai.com", "chatgpt.com", "auth.openai.com"];
+    if (env.OPENAI_BASE_URL) {
+        try {
+            hosts.push(new URL(env.OPENAI_BASE_URL).host);
+        }
+        catch {
+            // not a URL: nothing to add
+        }
+    }
+    return hosts;
+}
+/** Codex item kinds that are tool calls; the turn watchdog counts these. */
+const TOOL_ITEM_KINDS = new Set([
+    "command_execution",
+    "file_change",
+    "mcp_tool_call",
+    "web_search",
+    "collab_tool_call",
+]);
+// ─── Helpers ─────────────────────────────────────────────────────
+/** A TOML value for `-c key=value`, as the official SDK writes it (sdk/typescript/src/exec.ts). */
+export function toTomlValue(value) {
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("codex config: numbers must be finite");
+        return String(value);
+    }
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (Array.isArray(value))
+        return `[${value.map(toTomlValue).join(", ")}]`;
+    if (value && typeof value === "object") {
+        const parts = Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .map(([k, v]) => `${/^[A-Za-z0-9_-]+$/.test(k) ? k : JSON.stringify(k)} = ${toTomlValue(v)}`);
+        return `{${parts.join(", ")}}`;
+    }
+    throw new Error(`codex config: unsupported value ${String(value)}`);
+}
+/** A dotted config key segment, quoted when it is not a bare TOML key. */
+function keySegment(k) {
+    return /^[A-Za-z0-9_-]+$/.test(k) ? k : JSON.stringify(k);
+}
+function cfg(key, value) {
+    return ["-c", `${key}=${toTomlValue(value)}`];
+}
+function compareVersions(a, b) {
+    const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+    const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+    for (let i = 0; i < 3; i++) {
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) - (pb[i] ?? 0);
+    }
+    return 0;
+}
+/**
+ * Split `disallowed_tools` names into portable classes Codex can act on and
+ * the names it has no tool for.
+ */
+export function translateDenyNames(names = []) {
+    const classes = [];
+    const unknown = [];
+    for (const n of names) {
+        const mapped = DENY_NAME_TO_CLASSES[n];
+        if (mapped)
+            classes.push(...mapped);
+        else
+            unknown.push(n);
+    }
+    return { classes: [...new Set(classes)], unknown };
+}
+/**
+ * Is this JSON schema accepted by OpenAI strict structured outputs? Codex
+ * sends `--output-schema` with `strict: true` (core/src/session/turn.rs), which
+ * requires `additionalProperties: false` and every property listed in
+ * `required` on every object. Not a full check; it catches the common misses.
+ */
+export function isStrictCompatibleSchema(schema) {
+    const visit = (s) => {
+        if (!s || typeof s !== "object")
+            return true;
+        const o = s;
+        const props = o.properties;
+        if (o.type === "object" || props) {
+            if (o.additionalProperties !== false)
+                return false;
+            const req = Array.isArray(o.required) ? o.required : [];
+            for (const k of Object.keys(props ?? {}))
+                if (!req.includes(k))
+                    return false;
+            for (const v of Object.values(props ?? {}))
+                if (!visit(v))
+                    return false;
+        }
+        if (o.items && !visit(o.items))
+            return false;
+        for (const key of ["anyOf", "oneOf", "allOf"]) {
+            const list = o[key];
+            if (Array.isArray(list) && !list.every(visit))
+                return false;
+        }
+        for (const key of ["$defs", "definitions"]) {
+            const defs = o[key];
+            if (defs && !Object.values(defs).every(visit))
+                return false;
+        }
+        return true;
+    };
+    return visit(schema);
+}
+// ─── Process registry (crash cleanup) ────────────────────────────
+const liveChildren = new Set();
+let exitHookInstalled = false;
+/**
+ * Stop Codex. It stays in sweny's process group (not detached), so a Ctrl-C
+ * or a CI cancel reaches it too; its MCP servers exit when their stdin closes.
+ */
+function stopChild(child, signal) {
+    if (child.pid === undefined || child.exitCode !== null || child.signalCode !== null)
+        return;
+    try {
+        child.kill(signal);
+    }
+    catch {
+        // already gone
+    }
+}
+function trackChild(child) {
+    liveChildren.add(child);
+    if (!exitHookInstalled) {
+        exitHookInstalled = true;
+        // A crashing sweny must not leave Codex (and its MCP servers) running.
+        process.on("exit", () => {
+            for (const c of liveChildren)
+                stopChild(c, "SIGKILL");
+        });
+    }
+}
+function mapUsage(u) {
+    if (!u || typeof u !== "object")
+        return undefined;
+    const m = u;
+    const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+    const usage = {
+        inputTokens: num(m.input_tokens),
+        outputTokens: num(m.output_tokens),
+        cacheReadTokens: num(m.cached_input_tokens),
+        cacheCreationTokens: num(m.cache_write_input_tokens),
+    };
+    const present = Object.fromEntries(Object.entries(usage).filter(([, v]) => v !== undefined));
+    return Object.keys(present).length > 0 ? present : undefined;
+}
+// ─── Adapter ─────────────────────────────────────────────────────
+export class CodexHarness {
+    id = "codex";
+    capabilities = CODEX_CAPABILITIES;
+    /**
+     * Empty on purpose: judges use Codex's own default model. Leaving this
+     * undefined would fall back to the Claude judge model, which Codex cannot run.
+     */
+    defaultJudgeModel = "";
+    logger;
+    model;
+    maxTurns;
+    cwd;
+    defaultContext;
+    mcpServers;
+    defaultMcpServers;
+    envPassthrough;
+    envScope;
+    sandboxMode;
+    sandboxProbe;
+    sandboxWarned = false;
+    sandboxWrapper;
+    loginWarned = false;
+    policyMode;
+    codexCommand;
+    toolBridgeShim;
+    killGraceMs;
+    preflightResult;
+    version = "unknown";
+    constructor(opts = {}) {
+        this.model = opts.model;
+        this.maxTurns = opts.maxTurns ?? 20;
+        this.cwd = opts.cwd ?? process.cwd();
+        this.logger = opts.logger ?? consoleLogger;
+        this.defaultContext = opts.defaultContext ?? { config: {}, logger: this.logger };
+        this.mcpServers = opts.mcpServers ?? {};
+        this.defaultMcpServers = opts.defaultMcpServers ?? {};
+        this.envPassthrough = opts.envPassthrough;
+        this.envScope = opts.envScope;
+        this.sandboxMode = opts.sandbox;
+        this.sandboxProbe = opts.sandboxProbe;
+        this.sandboxWrapper = opts.sandboxWrapper;
+        this.policyMode = opts.policy ?? resolveHarnessPolicy(process.env, undefined, this.logger);
+        this.codexCommand = opts.codexCommand ?? { command: process.env.SWENY_CODEX_PATH || "codex", args: [] };
+        this.toolBridgeShim = opts.toolBridgeShim;
+        this.killGraceMs = opts.killGraceMs ?? 2000;
+    }
+    info() {
+        return { id: this.id, version: this.version };
+    }
+    /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
+    preflight() {
+        this.preflightResult ??= new Promise((resolve) => {
+            const { command, args } = this.codexCommand;
+            execFile(command, [...args, "--version"], { timeout: 30_000 }, (err, stdout) => {
+                if (err) {
+                    const code = err.code;
+                    resolve({
+                        ok: false,
+                        reason: code === "ENOENT"
+                            ? `codex CLI not found ("${command}"). Install it: npm install -g @openai/codex (>= ${MIN_CODEX_VERSION})`
+                            : `codex --version failed: ${err.message}`,
+                    });
+                    return;
+                }
+                const m = /(\d+\.\d+\.\d+)/.exec(String(stdout));
+                if (!m) {
+                    resolve({ ok: false, reason: `could not read the codex version from "${String(stdout).trim()}"` });
+                    return;
+                }
+                if (compareVersions(m[1], MIN_CODEX_VERSION) < 0) {
+                    resolve({ ok: false, reason: `codex ${m[1]} is too old; sweny needs >= ${MIN_CODEX_VERSION}` });
+                    return;
+                }
+                this.version = m[1];
+                resolve({ ok: true, version: m[1] });
+            });
+        });
+        return this.preflightResult;
+    }
+    /** Env for the Codex process: scoped like Claude Code's, with Codex's auth vars instead of Anthropic's. */
+    buildEnv(extraVars = []) {
+        const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
+        const authed = resolveCodexAuthEnv(full);
+        if (!resolveEnvScope(process.env, this.envScope, this.logger))
+            return authed;
+        const { env, withheld } = scopeAgentEnv(authed, {
+            extraVars,
+            passthrough: this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH),
+            authVars: CODEX_AUTH_VARS,
+            prefixes: CODEX_ENV_PREFIXES,
+            logger: this.logger,
+        });
+        reportWithheldEnv(withheld, this.logger);
+        return env;
+    }
+    /** The node policy after `disallowed_tools` names are translated into Codex classes. */
+    compilePolicy(req, maxTurns) {
+        const base = req.policy ?? {
+            readOnly: !!req.readOnly,
+            deny: req.deny ?? [],
+            nativeDeny: req.disallowedTools,
+            egress: req.agentAccess?.domains ?? [],
+            strict: this.policyMode === "strict",
+        };
+        const { classes, unknown } = translateDenyNames(base.nativeDeny);
+        return {
+            ...base,
+            deny: [...new Set([...base.deny, ...classes])],
+            nativeDeny: unknown,
+            maxTurns: base.maxTurns ?? maxTurns,
+        };
+    }
+    /** Resolve the Codex `--sandbox` value for a normal (not read-only) run. */
+    resolveSandbox(mode) {
+        if (mode === "off")
+            return { mode: "danger-full-access" };
+        const reason = (this.sandboxProbe ?? (() => checkSandboxSupport()))();
+        if (!reason)
+            return { mode: "workspace-write" };
+        if (mode === "strict") {
+            return {
+                mode: "workspace-write",
+                error: `SWENY_SANDBOX=strict but the Codex sandbox cannot run on this host: ${reason}`,
+            };
+        }
+        if (!this.sandboxWarned) {
+            this.sandboxWarned = true;
+            const prefix = process.env.GITHUB_ACTIONS === "true" ? "::warning title=SWEny agent sandbox::" : "";
+            this.logger.warn(`${prefix}Codex commands will run unsandboxed (SWENY_SANDBOX=auto): ${reason}`);
+        }
+        return { mode: "danger-full-access" };
+    }
+    /** argv shared by run() and complete(). */
+    baseArgs(opts) {
+        const args = [
+            ...this.codexCommand.args,
+            "exec",
+            "--json",
+            "--color",
+            "never",
+            "--skip-git-repo-check",
+            "--ephemeral",
+            "--ignore-user-config",
+            "--ignore-rules",
+            "--cd",
+            this.cwd,
+            "--sandbox",
+            opts.sandbox,
+            ...cfg("approval_policy", "never"),
+            ...cfg("check_for_update_on_startup", false),
+            ...cfg("developer_instructions", SYSTEM_PROMPT),
+        ];
+        if (opts.model)
+            args.push("--model", opts.model);
+        for (const f of CODEX_ISOLATION_FEATURES_OFF)
+            args.push(...cfg(`features.${f}`, false));
+        if (opts.deny.has("shell"))
+            args.push(...cfg("features.shell_tool", false));
+        if (opts.deny.has("net"))
+            args.push(...cfg("web_search", "disabled"));
+        if (opts.deny.has("subagent")) {
+            args.push(...cfg("features.multi_agent", false), ...cfg("agents.enabled", false));
+        }
+        if (opts.sandbox === "workspace-write") {
+            args.push(...cfg("sandbox_workspace_write.network_access", opts.network));
+        }
+        const baseUrl = process.env.OPENAI_BASE_URL;
+        if (baseUrl)
+            args.push(...cfg("openai_base_url", baseUrl));
+        return args;
+    }
+    /** `-c mcp_servers.<id>.*` for each server. Returns the args and anything Codex cannot load. */
+    mcpArgs(servers) {
+        const args = [];
+        const unsupported = [];
+        for (const [id, s] of Object.entries(servers)) {
+            const key = `mcp_servers.${keySegment(id)}`;
+            if (s.type === "http" || (!s.type && s.url && !s.command)) {
+                if (!s.url) {
+                    unsupported.push(`${id} (http without url)`);
+                    continue;
+                }
+                args.push(...cfg(`${key}.url`, s.url));
+                if (s.headers && Object.keys(s.headers).length > 0)
+                    args.push(...cfg(`${key}.http_headers`, s.headers));
+                continue;
+            }
+            if (!s.command) {
+                unsupported.push(`${id} (type ${String(s.type)})`);
+                continue;
+            }
+            args.push(...cfg(`${key}.command`, s.command));
+            if (s.args && s.args.length > 0)
+                args.push(...cfg(`${key}.args`, s.args));
+            if (s.env && Object.keys(s.env).length > 0)
+                args.push(...cfg(`${key}.env`, s.env));
+        }
+        return { args, unsupported };
+    }
+    /** Spawn codex exec, feed the prompt on stdin, and read JSONL until it exits. */
+    async exec(opts) {
+        const out = {
+            completed: false,
+            exitCode: null,
+            exitSignal: null,
+            stderrTail: "",
+            messages: [],
+            toolCalls: [],
+        };
+        const byId = new Map();
+        let toolCount = 0;
+        let stopped = false;
+        const abort = makeAbort(opts.timeoutMs, opts.signal);
+        if (abort?.controller.signal.aborted) {
+            // Aborted before Codex started: nothing to spawn or stop.
+            abort.clear();
+            out.abortReason = abort.reason();
+            return out;
+        }
+        let child;
+        try {
+            child = spawn(opts.spawn.command, opts.spawn.args, {
+                cwd: opts.spawn.cwd,
+                env: opts.spawn.env,
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+        catch (err) {
+            abort?.clear();
+            out.spawnError = err instanceof Error ? err.message : String(err);
+            return out;
+        }
+        trackChild(child);
+        const closed = new Promise((resolve) => {
+            child.once("close", (code, signal) => {
+                out.exitCode = code;
+                out.exitSignal = signal;
+                resolve();
+            });
+            child.once("error", (err) => {
+                out.spawnError = err.message;
+                resolve();
+            });
+        });
+        let killTimer;
+        const stop = () => {
+            if (stopped)
+                return;
+            stopped = true;
+            stopChild(child, "SIGTERM");
+            killTimer = setTimeout(() => stopChild(child, "SIGKILL"), this.killGraceMs);
+            killTimer.unref?.();
+        };
+        if (abort) {
+            const onAbort = () => {
+                out.abortReason = abort.reason();
+                stop();
+            };
+            abort.controller.signal.addEventListener("abort", onAbort, { once: true });
+            if (abort.controller.signal.aborted)
+                onAbort();
+        }
+        child.stdin?.on("error", () => {
+            // Codex exited before reading the prompt; the exit code tells the story.
+        });
+        child.stdin?.end(opts.prompt);
+        child.stderr?.setEncoding("utf8");
+        child.stderr?.on("data", (chunk) => {
+            this.logger.debug(`[codex] ${chunk.trimEnd()}`);
+            out.stderrTail = (out.stderrTail + chunk).slice(-2000);
+        });
+        const startCall = (id, call) => {
+            out.toolCalls.push(call);
+            byId.set(id, call);
+            toolCount++;
+            if (opts.maxToolCalls !== undefined && toolCount > opts.maxToolCalls && !out.overBudget) {
+                out.overBudget = { count: toolCount, limit: opts.maxToolCalls };
+                stop();
+            }
+        };
+        const onItem = (phase, item) => {
+            const id = typeof item.id === "string" ? item.id : "";
+            const kind = item.type;
+            if (kind === "agent_message") {
+                if (phase === "completed" && typeof item.text === "string")
+                    out.messages.push(item.text);
+                return;
+            }
+            if (kind === "error") {
+                if (typeof item.message === "string")
+                    this.logger.warn(`  codex: ${item.message}`);
+                return;
+            }
+            if (!TOOL_ITEM_KINDS.has(kind))
+                return;
+            let call = byId.get(id);
+            if (!call) {
+                if (phase === "updated")
+                    return;
+                const input = kind === "command_execution"
+                    ? { command: item.command }
+                    : kind === "file_change"
+                        ? { changes: item.changes }
+                        : kind === "mcp_tool_call"
+                            ? item.arguments
+                            : kind === "web_search"
+                                ? { query: item.query }
+                                : { prompt: item.prompt };
+                const tool = kind === "command_execution"
+                    ? "shell"
+                    : kind === "file_change"
+                        ? "apply_patch"
+                        : kind === "mcp_tool_call" || kind === "collab_tool_call"
+                            ? String(item.tool ?? "")
+                            : "web_search";
+                call = { tool, input };
+                startCall(id, call);
+                const detail = kind === "command_execution" ? `shell: ${String(item.command ?? "")}` : tool;
+                opts.onProgress?.(detail.length > 80 ? detail.slice(0, 79) + "…" : detail);
+            }
+            if (phase !== "completed" || call.status !== undefined)
+                return;
+            const status = String(item.status ?? "");
+            if (kind === "mcp_tool_call") {
+                const resultIsError = item.result?.is_error === true || item.result?.isError === true;
+                if (status === "failed" || resultIsError || item.error) {
+                    const detail = item.error?.message ?? parseToolResultContent(item.result?.content ?? "");
+                    call.status = "error";
+                    call.output = { error: detail };
+                    this.logger.warn(`  tool ${call.tool} failed: ${summarizeToolError(detail)}`);
+                }
+                else {
+                    const content = item.result?.content;
+                    const hasContent = Array.isArray(content) ? content.length > 0 : content !== undefined;
+                    call.status = "success";
+                    call.output = hasContent ? parseToolResultContent(content) : (item.result?.structured_content ?? null);
+                }
+            }
+            else if (kind === "command_execution") {
+                const ok = status === "completed" && (item.exit_code === 0 || item.exit_code === undefined);
+                call.status = ok ? "success" : "error";
+                call.output = ok ? item.aggregated_output : { error: item.aggregated_output ?? status };
+            }
+            else {
+                const ok = status !== "failed";
+                call.status = ok ? "success" : "error";
+                call.output = ok ? (item.results ?? item.changes ?? null) : { error: status };
+            }
+        };
+        let buf = "";
+        const onLine = (line) => {
+            if (stopped && out.overBudget)
+                return;
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            let ev;
+            try {
+                ev = JSON.parse(trimmed);
+            }
+            catch {
+                this.logger.debug(`[codex] non-JSON stdout line ignored`);
+                return;
+            }
+            switch (ev.type) {
+                case "item.started":
+                case "item.updated":
+                case "item.completed":
+                    if (ev.item && typeof ev.item === "object")
+                        onItem(ev.type.slice(5), ev.item);
+                    break;
+                case "turn.completed":
+                    out.completed = true;
+                    out.usage = mapUsage(ev.usage);
+                    break;
+                case "turn.failed":
+                    out.failure = String(ev.error?.message ?? "turn failed");
+                    break;
+                case "error":
+                    // Codex also reports errors it retries past (exec's jsonl processor
+                    // maps every app-server Error notification here), so this is only
+                    // the reason when no turn.completed follows.
+                    out.lastError = String(ev.message ?? "codex error");
+                    break;
+                default:
+                    break;
+            }
+        };
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            buf += chunk;
+            let nl;
+            while ((nl = buf.indexOf("\n")) !== -1) {
+                const line = buf.slice(0, nl);
+                buf = buf.slice(nl + 1);
+                onLine(line);
+            }
+        });
+        await closed;
+        // A final line without a newline is complete only if it parses.
+        if (buf.trim())
+            onLine(buf);
+        if (killTimer)
+            clearTimeout(killTimer);
+        abort?.clear();
+        liveChildren.delete(child);
+        return out;
+    }
+    /**
+     * Run a node. The gate runs first: in strict mode a node whose opinions
+     * Codex cannot honor is refused before Codex starts. With a sandbox mode
+     * other than off, the whole Codex process runs inside the host's process
+     * sandbox wrapper (#360 step 2) when there is one, which also keeps the
+     * node's per-host egress allowlist that Codex cannot keep itself.
+     */
+    async run(req) {
+        const maxTurns = req.maxTurns ?? this.maxTurns;
+        const mode = req.policy?.sandbox ?? resolveSandboxMode(process.env, this.sandboxMode, this.logger);
+        const policy = { ...this.compilePolicy(req, maxTurns), sandbox: mode };
+        // Codex's network is one switch, not a host list, so any sandbox mode but
+        // off needs the process wrapper for full containment.
+        const needsWrapper = mode !== "off" && !(this.capabilities.sandbox.fs && this.capabilities.sandbox.network);
+        const wrapper = needsWrapper && this.sandboxWrapper !== null
+            ? (this.sandboxWrapper ?? (await defaultSandboxWrapper()).wrapper)
+            : undefined;
+        const gate = policyGate(this.capabilities, policy, wrappersFrom(wrapper));
+        let degraded = gate.degraded;
+        const tag = (r, extra = []) => ({
+            ...r,
+            harness: this.info(),
+            degraded: [...degraded, ...extra],
+        });
+        const refused = (why) => {
+            const msg = `codex refused this node: ${why}`;
+            this.logger.error(msg);
+            // `refused` keeps fail_soft from softening a policy refusal (executor.ts).
+            return tag({ status: "failed", data: { error: msg, refused: true }, toolCalls: [] });
+        };
+        if (gate.refuse)
+            return refused(gate.refuse);
+        const pre = await this.preflight();
+        if (!pre.ok) {
+            this.logger.error(pre.reason);
+            return tag({ status: "failed", data: { error: pre.reason }, toolCalls: [] });
+        }
+        const readOnly = policy.readOnly;
+        const deny = new Set(policy.deny);
+        if (readOnly)
+            for (const c of ["shell", "net", "subagent"])
+                deny.add(c);
+        let sandbox = "read-only";
+        if (!readOnly) {
+            if (wrapper) {
+                // The wrapper contains the whole process; Codex's own sandbox nested
+                // inside it would only get in the way.
+                sandbox = "danger-full-access";
+            }
+            else {
+                const s = this.resolveSandbox(mode);
+                if (s.error) {
+                    this.logger.error(s.error);
+                    return tag({ status: "failed", data: { error: s.error }, toolCalls: [] });
+                }
+                sandbox = s.mode;
+            }
+        }
+        const env = this.buildEnv(req.agentAccess?.envVars);
+        if (wrapper && !env.CODEX_API_KEY && !env.CODEX_ACCESS_TOKEN && !this.loginWarned) {
+            this.loginWarned = true;
+            this.logger.warn("Codex runs inside the sandbox wrapper, where a stored `codex login` is not readable; set CODEX_API_KEY or OPENAI_API_KEY.");
+        }
+        const extraDegraded = [];
+        let bridge;
+        let scratch;
+        try {
+            // Dry run: external MCP servers cannot be classified per tool, so only
+            // sweny's own (already read-filtered) skill tools remain.
+            const servers = readOnly
+                ? {}
+                : { ...this.defaultMcpServers, ...req.mcpServers, ...this.mcpServers };
+            const { args: mcpArgs, unsupported } = this.mcpArgs(servers);
+            if (unsupported.length > 0) {
+                const note = `mcp: codex cannot load ${unsupported.join(", ")}`;
+                this.logger.warn(`  ${note}`);
+                extraDegraded.push(note);
+            }
+            const toolArgs = [];
+            if (req.tools.length > 0) {
+                bridge = await startToolBridge({
+                    tools: req.tools,
+                    context: this.defaultContext,
+                    logger: this.logger,
+                    ...(this.toolBridgeShim ? { shimCommand: this.toolBridgeShim } : {}),
+                });
+                const shim = bridge.mcpServer;
+                // The token reaches the shim by name (`env_vars`), never in argv.
+                env[TOKEN_ENV] = bridge.token;
+                const key = "mcp_servers.sweny-core";
+                toolArgs.push(...cfg(`${key}.command`, shim.command), ...cfg(`${key}.args`, shim.args ?? []), ...cfg(`${key}.env`, { SWENY_NO_UPDATE_CHECK: "1" }), ...cfg(`${key}.env_vars`, [TOKEN_ENV]), ...cfg(`${key}.required`, true), ...cfg(`${key}.startup_timeout_sec`, 30), ...cfg(`${key}.tool_timeout_sec`, 600));
+            }
+            const prompt = buildNodePrompt(req.instruction, req.context, req.outputSchema);
+            let schemaArgs = [];
+            if (req.outputSchema) {
+                scratch = fs.mkdtempSync(path.join(os.tmpdir(), "sweny-codex-"));
+                const schemaPath = path.join(scratch, "output-schema.json");
+                fs.writeFileSync(schemaPath, JSON.stringify(req.outputSchema), { mode: 0o600 });
+                schemaArgs = ["--output-schema", schemaPath];
+            }
+            const argsFor = (withSchema) => [
+                ...this.baseArgs({
+                    model: req.model ?? this.model,
+                    sandbox,
+                    deny,
+                    network: !deny.has("net"),
+                }),
+                ...mcpArgs,
+                ...toolArgs,
+                ...(withSchema ? schemaArgs : []),
+                "-",
+            ];
+            // Gate and (maybe) wrap each spawn; the wrapper's scratch goes away with the process.
+            const execOnce = async (withSchema) => {
+                const prep = await prepareAgentSpawn({
+                    caps: this.capabilities,
+                    policy,
+                    spawn: { command: this.codexCommand.command, args: argsFor(withSchema), env, cwd: this.cwd },
+                    wrapper: wrapper ?? null,
+                    harnessEgress: codexBackendHosts(),
+                    env: process.env,
+                });
+                degraded = prep.degraded;
+                if (prep.refuse) {
+                    await prep.cleanup();
+                    return { refuse: prep.refuse };
+                }
+                try {
+                    return await this.exec({
+                        spawn: prep.spawn,
+                        prompt,
+                        timeoutMs: req.timeoutMs,
+                        signal: req.signal,
+                        maxToolCalls: maxTurns,
+                        onProgress: req.onProgress,
+                    });
+                }
+                finally {
+                    await prep.cleanup();
+                }
+            };
+            let out = await execOnce(schemaArgs.length > 0);
+            if ("refuse" in out)
+                return refused(out.refuse);
+            // OpenAI strict structured outputs reject some JSON schemas. When Codex
+            // fails on the schema before doing anything, run once more without the
+            // native schema: sweny still asks for it in the prompt and checks it.
+            if (schemaArgs.length > 0 &&
+                !out.completed &&
+                !out.abortReason &&
+                out.toolCalls.length === 0 &&
+                /schema|response_format|text\.format/i.test(`${out.failure ?? ""} ${out.lastError ?? ""} ${out.stderrTail}`)) {
+                const why = isStrictCompatibleSchema(req.outputSchema)
+                    ? "codex rejected the output schema"
+                    : "the output schema is not OpenAI strict-compatible";
+                extraDegraded.push(`structured_output: ${why}; sweny parsed and checked the output instead`);
+                this.logger.warn(`  codex: ${why}; retrying without --output-schema`);
+                const again = await execOnce(false);
+                if ("refuse" in again)
+                    return refused(again.refuse);
+                out = again;
+            }
+            return tag(this.toResult(out, req.outputSchema, req.timeoutMs), extraDegraded);
+        }
+        catch (err) {
+            const msg = `Codex run failed: ${err instanceof Error ? err.message : String(err)}`;
+            this.logger.error(msg);
+            return tag({ status: "failed", data: { error: msg }, toolCalls: [] }, extraDegraded);
+        }
+        finally {
+            await bridge?.close();
+            if (scratch)
+                fs.rmSync(scratch, { recursive: true, force: true });
+        }
+    }
+    /** Map one exec outcome onto a NodeResult with Claude Code's semantics. */
+    toResult(out, outputSchema, timeoutMs) {
+        const { toolCalls, usage } = out;
+        const withUsage = (r) => (usage ? { ...r, usage } : r);
+        const last = out.messages.at(-1) ?? "";
+        const fail = (error, partial = false) => {
+            this.logger.error(error);
+            return withUsage({
+                status: "failed",
+                data: { error, ...(partial && last.trim() !== "" ? { summary: last.trim() } : {}) },
+                toolCalls,
+            });
+        };
+        if (out.spawnError)
+            return fail(`Codex could not start: ${out.spawnError}`);
+        if (out.abortReason === "timeout")
+            return fail(`Codex run timed out after ${timeoutMs}ms`);
+        if (out.abortReason === "signal")
+            return fail("Codex run aborted");
+        if (out.overBudget) {
+            // Same shape as Claude Code's max_turns stop: partial text is kept for fail_soft nodes.
+            return fail(`Codex run terminated early: max_turns (${out.overBudget.limit} tool calls; stopped by the sweny watchdog)`, true);
+        }
+        if (out.failure)
+            return fail(`Codex run failed: ${out.failure}`, true);
+        if (!out.completed) {
+            if (out.lastError)
+                return fail(`Codex run failed: ${out.lastError}`, true);
+            const code = out.exitSignal ? `signal ${out.exitSignal}` : `code ${out.exitCode}`;
+            const tail = out.stderrTail.trim().split("\n").slice(-3).join(" | ");
+            return fail(out.exitCode === 0 && !out.exitSignal
+                ? `agent stream ended without a result message (${toolCalls.length} tool calls captured)`
+                : `Codex exited with ${code}${tail ? `: ${tail}` : ""}`);
+        }
+        if (out.exitCode !== 0 || out.exitSignal) {
+            const code = out.exitSignal ? `signal ${out.exitSignal}` : `code ${out.exitCode}`;
+            return fail(`Codex exited with ${code} after completing the turn`);
+        }
+        const parsed = tryParseJSON(last, outputSchema, this.logger, "Codex");
+        return withUsage({ status: "success", data: { summary: last, ...parsed }, toolCalls });
+    }
+    /**
+     * One completion: read-only sandbox, no shell, no web search, no subagents,
+     * no MCP. null when it failed (callers fail closed).
+     */
+    async complete(req) {
+        const purpose = req.purpose ?? "ask";
+        const failClosed = (why) => {
+            this.logger.warn(purpose === "evaluate"
+                ? `codex.evaluate: ${why}. Failing closed (no route decision).`
+                : `codex.ask: ${why}. Returning empty string.`);
+            return null;
+        };
+        const pre = await this.preflight();
+        if (!pre.ok)
+            return failClosed(pre.reason);
+        const args = [
+            ...this.baseArgs({
+                // An empty model (the judge default) means Codex's own default model.
+                model: req.model || this.model,
+                sandbox: "read-only",
+                deny: new Set(["shell", "net", "subagent"]),
+                network: false,
+            }),
+            "-",
+        ];
+        const out = await this.exec({
+            spawn: { command: this.codexCommand.command, args, env: this.buildEnv(), cwd: this.cwd },
+            prompt: req.prompt,
+            timeoutMs: req.timeoutMs,
+            signal: req.signal,
+            // Classification calls use no tools; any tool call is over budget.
+            maxToolCalls: 0,
+        });
+        if (out.spawnError)
+            return failClosed(`codex could not start: ${out.spawnError}`);
+        if (out.abortReason === "timeout")
+            return failClosed(`timed out after ${req.timeoutMs}ms`);
+        if (out.abortReason === "signal")
+            return failClosed("aborted");
+        if (out.overBudget)
+            return failClosed("the model tried to call a tool");
+        if (out.failure)
+            return failClosed(`codex failed: ${out.failure}`);
+        if (!out.completed)
+            return failClosed(out.lastError ?? "agent stream ended without a result message");
+        if (out.exitCode !== 0 || out.exitSignal)
+            return failClosed(`codex exited with code ${out.exitCode}`);
+        return out.messages.at(-1) ?? "";
+    }
+}