agent-dealer 0.1.13 → 0.3.0

package/bundle/server/dist/adapters/agent-health.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import fs from "node:fs";
-import { claudeBinExists, cursorBinExists, resolveClaudeBin, cursorInvokeArgs, resolveCursorBin, } from "../cli-env.js";
+import { claudeBinExists, cursorBinExists, resolveClaudeBin, cursorInvokeArgs, resolveCursorBin, resolveCodexBin, codexBinExists, } from "../cli-env.js";
 import { checkAgentDeckHealth, isAgentDeckMcpRegistered } from "./agent-deck.js";
 const RUNTIME_CACHE_MS = 60_000;
 const runtimeIssueCache = new Map();
@@ -41,6 +41,32 @@ async function runtimeIssuesUncached(runtime) {
         }
         return [];
     }
+    if (runtime === "codex_local") {
+        if (!codexBinExists()) {
+            const ver = await runCommand(resolveCodexBin(), ["--version"]);
+            if (!ver.ok) {
+                return [{ code: "cli_missing", message: "Codex CLI not found — install Codex (`codex`)" }];
+            }
+        }
+        const ver = await runCommand(resolveCodexBin(), ["--version"]);
+        if (!ver.ok) {
+            return [{ code: "cli_missing", message: "Codex CLI not found — install Codex (`codex`)" }];
+        }
+        // `codex --version` succeeds without auth — use login status for auth health.
+        const login = await runCommand(resolveCodexBin(), ["login", "status"]);
+        const out = login.output.toLowerCase();
+        const loggedIn = login.ok &&
+            (out.includes("logged in") || out.includes("authenticated") || out.includes("api key"));
+        if (!loggedIn) {
+            return [
+                {
+                    code: "runtime_auth",
+                    message: "Run `codex login` (or set OPENAI_API_KEY for automation)",
+                },
+            ];
+        }
+        return [];
+    }
     const status = await runCommand(resolveCursorBin(), cursorInvokeArgs(["status"]));
     if (!status.ok && !status.output.trim() && !cursorBinExists()) {
         return [{ code: "cli_missing", message: "cursor-agent not found — run: curl https://cursor.com/install -fsS | bash" }];
@@ -80,6 +106,7 @@ function agentSpecificIssues(agent, agentDeckOnline, mcpRegistered) {
             message: "Run agent-deck setup --client claude --start (Claude MCP not registered)",
         });
     }
+    // Codex deck binding uses the Agent Deck marketplace plugin (not `agent-deck use --client codex`).
     return issues;
 }
 export async function healthForAgent(agent, agentDeckOnline, runtimeIssuesByRuntime, mcpRegistered) {

package/bundle/server/dist/cli-env.js

@@ -75,3 +75,19 @@ export function cursorBinExists() {
     const bin = resolveCursorBin();
     return bin !== "cursor-agent" && bin !== "cursor" ? fs.existsSync(bin) : false;
 }
+/** Resolve Codex CLI binary (`codex` from OpenAI Codex install). */
+export function resolveCodexBin() {
+    const home = process.env.HOME ?? os.homedir();
+    if (process.env.CODEX_CLI)
+        return process.env.CODEX_CLI;
+    return (firstExisting([
+        path.join(home, ".local/bin/codex"),
+        path.join(home, ".codex/bin/codex"),
+        "/opt/homebrew/bin/codex",
+        "/usr/local/bin/codex",
+    ]) ?? "codex");
+}
+export function codexBinExists() {
+    const bin = resolveCodexBin();
+    return bin !== "codex" ? fs.existsSync(bin) : false;
+}

package/bundle/server/dist/cli-env.test.js

@@ -1,6 +1,6 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { cursorInvokeArgs } from "./cli-env.js";
+import { cursorInvokeArgs, resolveCodexBin } from "./cli-env.js";
 test("cursorInvokeArgs passes through for cursor-agent", () => {
     const prev = process.env.CURSOR_CLI;
     process.env.CURSOR_CLI = "/home/user/.local/bin/cursor-agent";
@@ -28,3 +28,16 @@ test("cursorInvokeArgs prepends agent subcommand for legacy cursor shim", () =>
             process.env.CURSOR_CLI = prev;
     }
 });
+test("resolveCodexBin respects CODEX_CLI override", () => {
+    const prev = process.env.CODEX_CLI;
+    process.env.CODEX_CLI = "/tmp/custom-codex";
+    try {
+        assert.equal(resolveCodexBin(), "/tmp/custom-codex");
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env.CODEX_CLI;
+        else
+            process.env.CODEX_CLI = prev;
+    }
+});

package/bundle/server/dist/db/index.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import Database from "better-sqlite3";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID, CURSOR_DEFAULT_MODEL, } from "@agent-dealer/shared";
+import { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID, BUILTIN_AGENT_CODEX_ID, CURSOR_DEFAULT_MODEL, } from "@agent-dealer/shared";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 export function getDataDir() {
     const home = process.env.AGENT_DEALER_HOME ?? path.join(os.homedir(), ".agent-dealer");
@@ -117,6 +117,7 @@ function seedBuiltinAgents(db) {
   `);
     insert.run(BUILTIN_AGENT_CLAUDE_ID, "Claude", "claude_code", now, now);
     insert.run(BUILTIN_AGENT_CURSOR_ID, "Cursor", "cursor_local", now, now);
+    insert.run(BUILTIN_AGENT_CODEX_ID, "Codex", "codex_local", now, now);
     db.prepare(`UPDATE agents SET
       default_plan_model = COALESCE(default_plan_model, ?),
       default_execute_model = COALESCE(default_execute_model, ?),

package/bundle/server/dist/queue/result-qa.js

@@ -3,7 +3,7 @@ import { addArtifact, getRun } from "../repository/runs.js";
 import { hasPendingQaExchange, latestExecuteSessionId } from "../repository/result-qa.js";
 import { runQa } from "../runners/qa.js";
 const ASKABLE_STATUSES = new Set(["review", "done"]);
-const QA_RUNTIMES = new Set(["claude_code", "cursor_local"]);
+const QA_RUNTIMES = new Set(["claude_code", "cursor_local", "codex_local"]);
 /** Ask the run's agent about its finished result. Read-only; never changes run status. */
 export function askResultQuestion(runId, question, opts) {
     // An empty question would persist a result_qa artifact that ResultQaContent then

package/bundle/server/dist/runners/claude.js

@@ -1,99 +1,15 @@
-import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { buildExecutionPrompt, buildExecutionContinuationPrompt, buildPlanPrompt, buildReflectPrompt, workspaceForRun } from "./prompts.js";
 import { humanFeedbackText, lineageParentExecuteSessionId } from "./run-context.js";
-import { getTemporalLogsDir } from "../paths.js";
 import { cursorInvokeArgs, resolveClaudeBin, resolveCursorBin } from "../cli-env.js";
 import { resolveBudgetForPhase, resolveModelForPhase, getRun } from "../repository/runs.js";
 import { budgetCliArgs } from "@agent-dealer/shared";
 import { buildClaudePhaseArgs } from "./claude-args.js";
-import { acquireSpawnSlot, killRunProcess, registerChild, releaseSpawnSlot, unregisterChild, } from "./process-registry.js";
+import { runCodex } from "./codex.js";
+import { logPathFor, spawnCli, timeoutMsForMode, } from "./spawn-cli.js";
 export { getActiveLogPath, killRunProcess } from "./process-registry.js";
-function timeoutMsForMode(mode) {
-    const envKey = mode === "plan"
-        ? "PLAN_TIMEOUT_MS"
-        : mode === "execute"
-            ? "EXECUTE_TIMEOUT_MS"
-            : mode === "reflect"
-                ? "REFLECT_TIMEOUT_MS"
-                : "QA_TIMEOUT_MS";
-    const defaults = {
-        plan: 15 * 60_000,
-        execute: 60 * 60_000,
-        reflect: 10 * 60_000,
-        qa: 5 * 60_000,
-    };
-    const raw = process.env[envKey];
-    if (raw !== undefined && raw !== "")
-        return Number(raw);
-    return defaults[mode];
-}
-async function spawnCli(runId, cmd, args, cwd, opts) {
-    await acquireSpawnSlot();
-    try {
-        return await new Promise((resolve, reject) => {
-            const stdoutChunks = [];
-            const stderrChunks = [];
-            let timedOut = false;
-            let settled = false;
-            const logStream = fs.createWriteStream(opts.logPath, { flags: "w" });
-            const child = spawn(cmd, args, {
-                cwd,
-                env: { ...process.env },
-                stdio: ["ignore", "pipe", "pipe"],
-            });
-            registerChild(runId, child, opts.logPath);
-            const finish = (exitCode) => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                unregisterChild(runId);
-                logStream.end();
-                const stderr = stderrChunks.join("");
-                if (stderr.trim()) {
-                    logStream.write(`\n--- stderr ---\n${stderr}`);
-                }
-                resolve({
-                    exitCode,
-                    transcript: stdoutChunks.join(""),
-                    timedOut,
-                });
-            };
-            const timer = setTimeout(() => {
-                timedOut = true;
-                killRunProcess(runId);
-                setTimeout(() => finish(124), 500);
-            }, opts.timeoutMs);
-            child.stdout?.on("data", (buf) => {
-                const chunk = buf.toString();
-                stdoutChunks.push(chunk);
-                logStream.write(buf);
-            });
-            child.stderr?.on("data", (buf) => {
-                stderrChunks.push(buf.toString());
-            });
-            child.on("error", (err) => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                unregisterChild(runId);
-                logStream.end();
-                reject(err);
-            });
-            child.on("close", (code) => finish(code ?? 1));
-        });
-    }
-    finally {
-        releaseSpawnSlot();
-    }
-}
-function logPathFor(run, mode) {
-    const logDir = getTemporalLogsDir();
-    return path.join(logDir, `${run.id}-${mode}-${Date.now()}.ndjson`);
-}
+export { logPathFor, spawnCli, timeoutMsForMode } from "./spawn-cli.js";
 export async function runClaude(run, mode = "execute", model, opts) {
     const mcpConfig = process.env.CLAUDE_MCP_CONFIG ?? path.join(process.env.HOME ?? "", ".claude.json");
     if (!fs.existsSync(mcpConfig)) {
@@ -152,6 +68,9 @@ export async function runAgent(run, mode = "execute", revise) {
     const model = resolveModelForPhase(fresh, mode);
     if (fresh.runtime === "cursor_local")
         return runCursor(fresh, mode, model);
+    if (fresh.runtime === "codex_local") {
+        return runCodex(fresh, mode, model ?? undefined, revise ? { promptOverride: revise.prompt, resumeSessionId: revise.resumeSessionId } : undefined);
+    }
     return runClaude(fresh, mode, model, revise ? { promptOverride: revise.prompt, resumeSessionId: revise.resumeSessionId } : undefined);
 }
 /** @deprecated use stream-json extractPlanMarkdown via persistRunOutput */

package/bundle/server/dist/runners/codex-args.js

@@ -0,0 +1,59 @@
+const FORBIDDEN_SANDBOX = "danger-full-access";
+const FORBIDDEN_FLAGS = [
+    "--dangerously-bypass-approvals-and-sandbox",
+    "--dangerously-bypass-hook-trust",
+];
+/** Phase → sandbox. Never returns danger-full-access. */
+export function codexSandboxForMode(mode) {
+    return mode === "execute" ? "workspace-write" : "read-only";
+}
+/**
+ * Build `codex` argv for non-interactive exec.
+ * Caller prepends nothing — pass these to spawn(resolveCodexBin(), args).
+ */
+export function buildCodexExecArgs(opts) {
+    const sandbox = codexSandboxForMode(opts.mode);
+    assertSafeSandbox(sandbox);
+    const args = [
+        "exec",
+        "--json",
+        "-C",
+        opts.workspaceRoot,
+        "-s",
+        sandbox,
+    ];
+    if (opts.model) {
+        args.push("-m", opts.model);
+    }
+    if (opts.outputSchemaPath) {
+        args.push("--output-schema", opts.outputSchemaPath);
+    }
+    if (opts.outputLastMessagePath) {
+        args.push("-o", opts.outputLastMessagePath);
+    }
+    for (const dir of opts.addDirs ?? []) {
+        args.push("--add-dir", dir);
+    }
+    // Prompt is user-controlled — do not include it in flag safety checks.
+    if (opts.resumeSessionId) {
+        args.push("resume", opts.resumeSessionId, opts.prompt);
+    }
+    else {
+        args.push(opts.prompt);
+    }
+    assertNoDangerFlags(args.slice(0, -1)); // exclude trailing prompt
+    return args;
+}
+function assertSafeSandbox(sandbox) {
+    if (sandbox === FORBIDDEN_SANDBOX) {
+        throw new Error("codex managed runner refused dangerous sandbox/bypass flags");
+    }
+}
+/** Validate generated option tokens only — never the prompt string. */
+function assertNoDangerFlags(generatedArgs) {
+    for (const token of generatedArgs) {
+        if (token === FORBIDDEN_SANDBOX || FORBIDDEN_FLAGS.includes(token)) {
+            throw new Error("codex managed runner refused dangerous sandbox/bypass flags");
+        }
+    }
+}

package/bundle/server/dist/runners/codex-args.test.js

@@ -0,0 +1,72 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { buildCodexExecArgs, codexSandboxForMode } from "./codex-args.js";
+test("codexSandboxForMode maps plan/qa to read-only and execute to workspace-write", () => {
+    assert.equal(codexSandboxForMode("plan"), "read-only");
+    assert.equal(codexSandboxForMode("qa"), "read-only");
+    assert.equal(codexSandboxForMode("execute"), "workspace-write");
+});
+test("buildCodexExecArgs includes json, cd, sandbox, and prompt", () => {
+    const args = buildCodexExecArgs({
+        mode: "plan",
+        workspaceRoot: "/tmp/ws",
+        prompt: "draft a plan",
+    });
+    assert.deepEqual(args, [
+        "exec",
+        "--json",
+        "-C",
+        "/tmp/ws",
+        "-s",
+        "read-only",
+        "draft a plan",
+    ]);
+});
+test("buildCodexExecArgs resume places subcommand before prompt", () => {
+    const args = buildCodexExecArgs({
+        mode: "execute",
+        workspaceRoot: "/tmp/ws",
+        prompt: "fix the findings",
+        resumeSessionId: "thread-abc",
+        model: "gpt-5.6-sol",
+    });
+    assert.ok(args.includes("-s") && args[args.indexOf("-s") + 1] === "workspace-write");
+    assert.deepEqual(args.slice(-3), ["resume", "thread-abc", "fix the findings"]);
+    assert.ok(args.includes("-m") && args[args.indexOf("-m") + 1] === "gpt-5.6-sol");
+});
+test("buildCodexExecArgs supports output-schema and -o", () => {
+    const args = buildCodexExecArgs({
+        mode: "qa",
+        workspaceRoot: "/tmp/ws",
+        prompt: "answer",
+        outputSchemaPath: "/tmp/schema.json",
+        outputLastMessagePath: "/tmp/last.json",
+        addDirs: ["/tmp/extra"],
+    });
+    assert.ok(args.includes("--output-schema"));
+    assert.equal(args[args.indexOf("--output-schema") + 1], "/tmp/schema.json");
+    assert.ok(args.includes("-o"));
+    assert.equal(args[args.indexOf("-o") + 1], "/tmp/last.json");
+    assert.ok(args.includes("--add-dir"));
+    assert.equal(args[args.indexOf("--add-dir") + 1], "/tmp/extra");
+    assert.equal(args[args.indexOf("-s") + 1], "read-only");
+});
+test("buildCodexExecArgs never emits danger flags", () => {
+    const args = buildCodexExecArgs({
+        mode: "execute",
+        workspaceRoot: "/tmp/ws",
+        prompt: "go",
+    });
+    const joined = args.join(" ");
+    assert.equal(joined.includes("danger-full-access"), false);
+    assert.equal(joined.includes("dangerously-bypass"), false);
+});
+test("buildCodexExecArgs allows danger-full-access in the prompt text", () => {
+    const args = buildCodexExecArgs({
+        mode: "plan",
+        workspaceRoot: "/tmp/ws",
+        prompt: "verify that danger-full-access is never used",
+    });
+    assert.equal(args.at(-1), "verify that danger-full-access is never used");
+    assert.equal(args[args.indexOf("-s") + 1], "read-only");
+});

package/bundle/server/dist/runners/codex-jsonl.js

@@ -0,0 +1,150 @@
+export function parseCodexJsonl(raw) {
+    const stdoutOnly = stripStderrTrailer(raw);
+    const events = [];
+    for (const line of stdoutOnly.split("\n")) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        try {
+            events.push(JSON.parse(t));
+        }
+        catch {
+            // skip non-json (e.g. trailing stderr markers if present)
+        }
+    }
+    return events;
+}
+/** spawnCli appends stderr after a marker — ignore that for JSONL parse. */
+export function stripStderrTrailer(raw) {
+    const idx = raw.indexOf("\n--- stderr ---\n");
+    return idx >= 0 ? raw.slice(0, idx) : raw;
+}
+export function extractCodexThreadId(events) {
+    for (const e of events) {
+        if (e.type === "thread.started" && typeof e.thread_id === "string") {
+            return e.thread_id;
+        }
+    }
+    return undefined;
+}
+function itemOf(e) {
+    const item = e.item;
+    if (item && typeof item === "object")
+        return item;
+    return undefined;
+}
+export function extractCodexResultText(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.type !== "item.completed")
+            continue;
+        const item = itemOf(e);
+        if (item?.type === "agent_message" && typeof item.text === "string" && item.text.length > 0) {
+            return item.text;
+        }
+    }
+    return undefined;
+}
+function usageFromTurn(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.type !== "turn.completed")
+            continue;
+        const usage = e.usage;
+        if (!usage || typeof usage !== "object")
+            return undefined;
+        const u = usage;
+        const out = {};
+        if (typeof u.input_tokens === "number")
+            out.input_tokens = u.input_tokens;
+        if (typeof u.output_tokens === "number")
+            out.output_tokens = u.output_tokens;
+        if (typeof u.cached_input_tokens === "number")
+            out.cache_read_input_tokens = u.cached_input_tokens;
+        if (typeof u.reasoning_output_tokens === "number") {
+            out.output_tokens = (out.output_tokens ?? 0) + u.reasoning_output_tokens;
+        }
+        return Object.keys(out).length > 0 ? out : undefined;
+    }
+    return undefined;
+}
+function errorMessage(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.type === "turn.failed") {
+            const err = e.error;
+            if (typeof err === "string")
+                return err;
+            if (err && typeof err === "object" && typeof err.message === "string") {
+                return err.message;
+            }
+            return "turn failed";
+        }
+        if (e.type === "error") {
+            if (typeof e.message === "string")
+                return e.message;
+            return "codex error";
+        }
+    }
+    return undefined;
+}
+/**
+ * Map Codex JSONL events into Claude/Cursor-shaped NDJSON so persist extractors work unchanged.
+ */
+export function normalizeCodexEvents(events) {
+    const out = [];
+    const threadId = extractCodexThreadId(events);
+    if (threadId) {
+        out.push({ type: "system", subtype: "init", session_id: threadId });
+    }
+    for (const e of events) {
+        if (e.type === "item.completed" || e.type === "item.started" || e.type === "item.updated") {
+            const item = itemOf(e);
+            if (!item)
+                continue;
+            const itemType = String(item.type ?? "");
+            if (itemType === "agent_message" && typeof item.text === "string" && item.text) {
+                out.push({
+                    type: "assistant",
+                    message: { content: [{ type: "text", text: item.text }] },
+                });
+            }
+            else if (itemType === "reasoning" && typeof item.text === "string" && item.text) {
+                out.push({ type: "thinking", text: item.text });
+            }
+            else if (itemType === "command_execution") {
+                const cmd = typeof item.command === "string" ? item.command : "command";
+                out.push({ type: "tool_call", name: "Bash", text: cmd });
+            }
+            else if (itemType === "mcp_tool_call") {
+                const name = typeof item.name === "string" ? item.name : "mcp";
+                out.push({ type: "tool_call", name });
+            }
+            else if (itemType === "file_change") {
+                out.push({ type: "tool_call", name: "Edit" });
+            }
+        }
+    }
+    const err = errorMessage(events);
+    const resultText = extractCodexResultText(events);
+    const usage = usageFromTurn(events);
+    if (err) {
+        out.push({
+            type: "result",
+            is_error: true,
+            result: err,
+            ...(usage ? { usage } : {}),
+        });
+    }
+    else if (resultText) {
+        out.push({
+            type: "result",
+            result: resultText,
+            ...(usage ? { usage } : {}),
+        });
+    }
+    else if (usage) {
+        out.push({ type: "result", result: "", usage });
+    }
+    return out;
+}

package/bundle/server/dist/runners/codex-jsonl.test.js

@@ -0,0 +1,36 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { extractCodexResultText, extractCodexThreadId, normalizeCodexEvents, parseCodexJsonl, } from "./codex-jsonl.js";
+import { extractSessionId, extractResultText, extractUsage } from "./stream-json.js";
+const SAMPLE = `
+{"type":"thread.started","thread_id":"0199a213-81c0-7800-8aa1-bbab2a035a53"}
+{"type":"turn.started"}
+{"type":"item.started","item":{"id":"item_1","type":"command_execution","command":"bash -lc ls","status":"in_progress"}}
+{"type":"item.completed","item":{"id":"item_3","type":"agent_message","text":"Repo contains docs, sdk, and examples directories."}}
+{"type":"turn.completed","usage":{"input_tokens":24763,"cached_input_tokens":24448,"output_tokens":122,"reasoning_output_tokens":0}}
+`.trim();
+test("parseCodexJsonl reads JSONL events", () => {
+    const events = parseCodexJsonl(SAMPLE);
+    assert.equal(events.length, 5);
+    assert.equal(extractCodexThreadId(events), "0199a213-81c0-7800-8aa1-bbab2a035a53");
+    assert.equal(extractCodexResultText(events), "Repo contains docs, sdk, and examples directories.");
+});
+test("normalizeCodexEvents feeds existing extractors", () => {
+    const normalized = normalizeCodexEvents(parseCodexJsonl(SAMPLE));
+    assert.equal(extractSessionId(normalized), "0199a213-81c0-7800-8aa1-bbab2a035a53");
+    assert.equal(extractResultText(normalized), "Repo contains docs, sdk, and examples directories.");
+    const usage = extractUsage(normalized, "plan", "codex_local");
+    assert.equal(usage.inputTokens, 24763);
+    assert.equal(usage.outputTokens, 122);
+    assert.equal(usage.cacheReadTokens, 24448);
+});
+test("normalizeCodexEvents marks turn.failed as error result", () => {
+    const raw = `
+{"type":"thread.started","thread_id":"t1"}
+{"type":"turn.failed","error":{"message":"sandbox denied"}}
+`.trim();
+    const normalized = normalizeCodexEvents(parseCodexJsonl(raw));
+    const result = normalized.find((e) => e.type === "result");
+    assert.equal(result?.is_error, true);
+    assert.equal(result?.result, "sandbox denied");
+});

package/bundle/server/dist/runners/codex-resume.test.js

@@ -0,0 +1,19 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { buildCodexExecArgs } from "./codex-args.js";
+test("execute resume argv matches Claude-style fix-round handoff", () => {
+    const args = buildCodexExecArgs({
+        mode: "execute",
+        workspaceRoot: "/tmp/ws",
+        prompt: "Address the human feedback and continue.",
+        resumeSessionId: "0199a213-81c0-7800-8aa1-bbab2a035a53",
+    });
+    assert.equal(args[0], "exec");
+    assert.ok(args.includes("--json"));
+    assert.equal(args[args.indexOf("-s") + 1], "workspace-write");
+    assert.deepEqual(args.slice(-3), [
+        "resume",
+        "0199a213-81c0-7800-8aa1-bbab2a035a53",
+        "Address the human feedback and continue.",
+    ]);
+});

package/bundle/server/dist/runners/codex.js

@@ -0,0 +1,46 @@
+import { resolveCodexBin } from "../cli-env.js";
+import { getTemporalOutputDir } from "../paths.js";
+import { buildCodexExecArgs } from "./codex-args.js";
+import { logPathFor, spawnCli, timeoutMsForMode } from "./spawn-cli.js";
+import { buildExecutionContinuationPrompt, buildExecutionPrompt, buildPlanPrompt, workspaceForRun, } from "./prompts.js";
+import { humanFeedbackText, lineageParentExecuteSessionId } from "./run-context.js";
+/**
+ * Resume session for Codex — mirrors Claude:
+ * explicit opts win; else execute + human feedback → lineage parent execute session.
+ */
+export function resolveCodexResumeSessionId(run, mode, optsResumeSessionId) {
+    if (optsResumeSessionId)
+        return optsResumeSessionId;
+    if (mode === "execute" && humanFeedbackText(run)) {
+        return lineageParentExecuteSessionId(run) ?? undefined;
+    }
+    return undefined;
+}
+export async function runCodex(run, mode = "execute", model, opts) {
+    if (mode === "qa" && !opts?.promptOverride) {
+        throw new Error("qa mode requires a promptOverride");
+    }
+    const resumeSessionId = resolveCodexResumeSessionId(run, mode, opts?.resumeSessionId);
+    const prompt = opts?.promptOverride ??
+        (mode === "plan"
+            ? buildPlanPrompt(run)
+            : resumeSessionId
+                ? buildExecutionContinuationPrompt(run)
+                : buildExecutionPrompt(run));
+    const logPath = logPathFor(run, mode);
+    const workspaceRoot = workspaceForRun(run);
+    // Match Claude execute: temporal output dir must be writable for document artifacts.
+    const addDirs = opts?.addDirs ?? (mode === "execute" ? [getTemporalOutputDir()] : undefined);
+    const args = buildCodexExecArgs({
+        mode,
+        workspaceRoot,
+        prompt,
+        model,
+        resumeSessionId,
+        outputSchemaPath: opts?.outputSchemaPath,
+        outputLastMessagePath: opts?.outputLastMessagePath,
+        addDirs,
+    });
+    const { exitCode, transcript, timedOut } = await spawnCli(run.id, resolveCodexBin(), args, workspaceRoot, { logPath, timeoutMs: timeoutMsForMode(mode) });
+    return { exitCode, transcript, logPath, timedOut };
+}

package/bundle/server/dist/runners/models-codex.test.js

@@ -0,0 +1,14 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { parseCodexModelsCache } from "./models.js";
+test("parseCodexModelsCache keeps visibility=list and drops hide", () => {
+    const models = parseCodexModelsCache({
+        models: [
+            { slug: "gpt-reserve", display_name: "GPT-Reserve", visibility: "hide" },
+            { slug: "gpt-5.6-sol", display_name: "GPT-5.6-Sol", visibility: "list" },
+            { slug: "codex-auto-review", display_name: "Codex Auto Review", visibility: "hide" },
+            { slug: "gpt-5.6-terra", display_name: "GPT-5.6-Terra", visibility: "list" },
+        ],
+    });
+    assert.deepEqual(models.map((m) => m.id), ["gpt-5.6-sol", "gpt-5.6-terra"]);
+});