devlyn-cli 2.10.1 → 3.0.0

package/config/skills/_shared/codex-config.md

@@ -38,6 +38,20 @@ CODEX_MONITORED_ISOLATED=1 bash "$CODEX_MONITORED_PATH" \
 bash "$CODEX_MONITORED_PATH" \
   -C <project-root> \
   -s workspace-write \
+  -c sandbox_workspace_write.network_access=false \
+  -c model_reasoning_effort=xhigh \
+  "<inlined-prompt>"
+```
+
+**CI-equivalent BUILD_GATE** keeps the same write sandbox and enables general
+outbound network access inside that sandbox, including the loopback servers and
+network-backed test gates that CI may exercise:
+
+```bash
+bash "$CODEX_MONITORED_PATH" \
+  -C <project-root> \
+  -s workspace-write \
+  -c sandbox_workspace_write.network_access=true \
   -c model_reasoning_effort=xhigh \
   "<inlined-prompt>"
 ```
@@ -45,10 +59,11 @@ bash "$CODEX_MONITORED_PATH" \
 Notes:
 - `-C` — project root so Codex's working directory matches.
 - `-s read-only` / `-s workspace-write` — sandbox policy. Use workspace-write for implementation/probe phases that write tracked files or `.devlyn` artifacts.
+- `-c sandbox_workspace_write.network_access=<true|false>` — required and receipt-bound for mutation phases: `true` only for BUILD_GATE and, per call, PROBE-DERIVE when the probe's visible Verification command requires a localhost service; `false` for PLAN, IMPLEMENT, CLEANUP, and PROBE-DERIVE by default. This allows CI-equivalent loopback/network tests without widening to `danger-full-access` and prevents user configuration from silently changing other phases.
 - `-c model_reasoning_effort=xhigh` — config override for reasoning depth. Required for deep critique; skills may choose `high` or `medium` when thoroughness doesn't warrant xhigh.
-- **Omit `-m <model>`** — Codex CLI uses its configured flagship (currently `gpt-5.5`, automatically whatever ships next). This is the zero-touch mechanism. Only name `-m` when a role explicitly needs a different model (e.g., `gpt-5.3-codex` for SWE-bench-heavy coding tasks, `gpt-5.3-codex-spark` for speed).
+- **For every receipt-bound Codex call, add `--json -m <model_requested>` to the recipes above**, matching the model recorded at spawn; keep the skill’s existing model-selection rules. Other routes keep their omission rules unless an explicit role profile supplies a model: normal workers may inherit user config, while unconfigured isolated VERIFY uses its CLI default. Explicit profiles use role-config.py options and the separate judge-role-evidence.py contract; they do not relax mutation receipts. Omission proves neither model identity nor role fitness. Re-certify seats after model/version changes before re-pinning them.
 - `CODEX_MONITORED_ISOLATED=1` — required for bounded read-only critique/probe/judge calls. The wrapper adds `--ignore-user-config --ignore-rules --ephemeral --disable codex_hooks --disable hooks` so user config, AGENTS.md, hooks, and project rules cannot add hidden context, tool calls, or transcript side effects. Do not set it for workspace-write implementation phases.
-- Wrapper calls are **foreground-blocking**. Never launch them via a backgrounded shell (`run_in_background`, `&`, `nohup`) and never end the orchestrator message while one runs: a headless print-mode session kills backgrounded children at wind-down (observed 2026-07-07: an FS1 A-arm IMPLEMENT codex call was killed at turn end → 0-byte delivery). The heartbeat stream is the observability channel; block on the call.
+- Wrapper calls are **foreground-blocking**. Never launch them via a backgrounded shell (`run_in_background`, `&`, `nohup`) and never end the orchestrator message while one runs: a headless print-mode session kills backgrounded children at wind-down (observed 2026-07-07: an FS1 A-arm IMPLEMENT codex call was killed at turn end → 0-byte delivery). The heartbeat stream is the observability channel; block on the call. Interactive Claude Code caps a foreground Bash call at `BASH_MAX_TIMEOUT_MS` (the installer sets at least 3600000 ms, IMPLEMENT's effective outer ceiling), so every foreground Codex wrapper call must pass the Bash `timeout` explicitly at that ceiling or the phase's own budget (for example, 600s judges) — never rely on the 120 s default.
 - Raw `codex exec ...` invocations are **forbidden** in skill prompts. The benchmark variant arm runs a PATH shim (`scripts/codex-shim/codex`) that transparently re-routes any raw `codex exec` to the wrapper as a safety net, but skills should always emit the wrapper form directly so the orchestrator's first-attempt has the right shape. Two prior iterations (iter-0006 universal foreground ban, iter-0008 prompt-level kill-shape contract) failed because the orchestrator picked starvation-prone shapes (`codex exec ... 2>&1 | tail -200`) from its own pattern prior — the wrapper plus the shim is the runtime binding layer those iters lacked. See `autoresearch/iterations/0009-wrapper-and-hook.md`.
 
 ## Availability check
@@ -63,10 +78,10 @@ If the check fails while Codex is explicitly selected or conditionally required
 
 ## Why CLI over other paths
 
-The local Codex CLI (fronted by `codex-monitored.sh`) is the primary (and only) integration. It beats alternatives on three dimensions: the model is inherited from the CLI's own default so no skill edits are needed when OpenAI ships a new flagship; flags compose on the command line and the skill docs stay grep-friendly; the invocation has one failure mode (the binary is on PATH or it isn't), which the shared availability check reports explicitly.
+The local Codex CLI, fronted by `codex-monitored.sh`, is the integration boundary. CLI flags compose with the existing phase routes and keep invocation evidence inspectable. The shared preflight checks availability; a present binary does not establish model identity or role fitness.
 
 ## Invocation from inside a skill prompt
 
 Skills write the invocation as a Bash command the runtime executes. Example shape from `/devlyn:resolve` PHASE 2 IMPLEMENT when routed to Codex:
 
-> Run `bash "$CODEX_MONITORED_PATH" -C <state.base_ref.repo_root> -s workspace-write -c model_reasoning_effort=xhigh "<IMPLEMENT prompt>"`. Omit `-m` so the CLI flagship is auto-selected. Capture stdout as the IMPLEMENT reply; non-zero exit → treat as subagent failure. The wrapper emits `[codex-monitored]` heartbeat and lifecycle lines on **stderr** — stdout stays clean for Codex output, so the orchestrator can parse the reply without filtering. Heartbeat-on-stderr keeps the orchestrator's combined-output stream non-silent (defeats the iter-0008 byte-watchdog kill) without polluting the codex-reply view of stdout. Do not pipe the wrapper; direct capture or file redirection preserves streaming and avoids the pipe-refusal exit.
+> Run `bash "$CODEX_MONITORED_PATH" --json -C <state.base_ref.repo_root> -s workspace-write -m <model_requested> -c sandbox_workspace_write.network_access=false -c model_reasoning_effort=xhigh "<IMPLEMENT prompt>"`. Capture stdout as the IMPLEMENT reply; non-zero exit → treat as subagent failure. The wrapper emits `[codex-monitored]` heartbeat and lifecycle lines on **stderr** — stdout stays clean for Codex output, so the orchestrator can parse the reply without filtering. Heartbeat-on-stderr keeps the orchestrator's combined-output stream non-silent (defeats the iter-0008 byte-watchdog kill) without polluting the codex-reply view of stdout. Do not pipe the wrapper; direct capture or file redirection preserves streaming and avoids the pipe-refusal exit.

package/config/skills/_shared/codex-monitored.sh

@@ -54,6 +54,10 @@
 #   CODEX_MONITORED_ALLOW_PIPED    — set non-empty to skip the pipe-stdout
 #                                     refusal. Reserved for tests; don't use
 #                                     in skill prompts.
+#   DEVLYN_INVOCATION_*             — run/phase/round/workdir/prompt/session/
+#                                     receipt identity. When any is set, all
+#                                     are required and the wrapper seals a
+#                                     canonical invocation receipt.
 
 set -uo pipefail
 
@@ -76,6 +80,19 @@ START=$(date +%s)
 TIMEOUT_FLAG=""
 CODEX_ARGS=("$@")
 
+for codex_arg in "${CODEX_ARGS[@]}"; do
+  case "$codex_arg" in
+    --dangerously-bypass-approvals-and-sandbox|--yolo)
+      printf '[codex-monitored] error: forbidden Codex bypass flag: %s\n' "$codex_arg" >&2
+      exit 64
+      ;;
+    danger-full-access|-s=danger-full-access|--sandbox=danger-full-access)
+      printf '[codex-monitored] error: forbidden Codex sandbox: danger-full-access\n' >&2
+      exit 64
+      ;;
+  esac
+done
+
 require_nonnegative_int() {
   local name="$1"
   local value="$2"
@@ -102,6 +119,34 @@ require_positive_int() {
 require_positive_int CODEX_MONITORED_HEARTBEAT "$HEARTBEAT_SEC"
 require_nonnegative_int CODEX_MONITORED_TIMEOUT_SEC "$TIMEOUT_SEC"
 
+RECEIPT_ENABLED=""
+for receipt_value in \
+  "${DEVLYN_INVOCATION_RUN_ID:-}" \
+  "${DEVLYN_INVOCATION_PHASE:-}" \
+  "${DEVLYN_INVOCATION_ROUND:-}" \
+  "${DEVLYN_INVOCATION_WORKDIR:-}" \
+  "${DEVLYN_INVOCATION_PROMPT_FILE:-}" \
+  "${DEVLYN_INVOCATION_SESSION_FILE:-}" \
+  "${DEVLYN_INVOCATION_RECEIPT:-}"; do
+  if [ -n "$receipt_value" ]; then
+    RECEIPT_ENABLED=1
+  fi
+done
+if [ -n "$RECEIPT_ENABLED" ]; then
+  for receipt_name in \
+    DEVLYN_INVOCATION_RUN_ID DEVLYN_INVOCATION_PHASE DEVLYN_INVOCATION_ROUND \
+    DEVLYN_INVOCATION_WORKDIR DEVLYN_INVOCATION_PROMPT_FILE \
+    DEVLYN_INVOCATION_SESSION_FILE DEVLYN_INVOCATION_RECEIPT; do
+    eval "receipt_value=\${$receipt_name:-}"
+    if [ -z "$receipt_value" ]; then
+      printf '[codex-monitored] error: %s is required for invocation receipt\n' \
+        "$receipt_name" >&2
+      exit 64
+    fi
+  done
+  require_nonnegative_int DEVLYN_INVOCATION_ROUND "$DEVLYN_INVOCATION_ROUND"
+fi
+
 if [ -n "${CODEX_MONITORED_ISOLATED:-}" ]; then
   CODEX_ARGS=(
     --ignore-user-config
@@ -187,16 +232,25 @@ terminate_process_group() {
   kill -KILL -- "-$pgid" 2>/dev/null || true
 }
 
+terminate_monitor_group() {
+  local pid="$1"
+  kill -TERM -- "-$pid" 2>/dev/null || kill -TERM "$pid" 2>/dev/null || true
+  kill -KILL -- "-$pid" 2>/dev/null || kill -KILL "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+}
+
 forward_signal() {
   local sig="$1"
   if [ -n "${CODEX_PID:-}" ] && kill -0 "$CODEX_PID" 2>/dev/null; then
     kill -"$sig" -- "-$CODEX_PID" 2>/dev/null || kill -"$sig" "$CODEX_PID" 2>/dev/null || true
   fi
-  if [ -n "${HB_PID:-}" ] && kill -0 "$HB_PID" 2>/dev/null; then
-    kill -TERM "$HB_PID" 2>/dev/null || true
+  if [ -n "${HB_PID:-}" ]; then
+    terminate_monitor_group "$HB_PID"
+    HB_PID=""
   fi
-  if [ -n "${WATCHDOG_PID:-}" ] && kill -0 "$WATCHDOG_PID" 2>/dev/null; then
-    kill -TERM "$WATCHDOG_PID" 2>/dev/null || true
+  if [ -n "${WATCHDOG_PID:-}" ]; then
+    terminate_monitor_group "$WATCHDOG_PID"
+    WATCHDOG_PID=""
   fi
 }
 
@@ -215,11 +269,23 @@ if [ -n "${CODEX_MONITORED_ISOLATED:-}" ]; then
   printf '[codex-monitored] isolated=1\n' >&2
 fi
 
+if [ -n "$RECEIPT_ENABLED" ]; then
+  RECEIPT_HELPER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/invocation-receipt.py"
+  python3 "$RECEIPT_HELPER" start \
+    --workdir "$DEVLYN_INVOCATION_WORKDIR" \
+    --receipt "$DEVLYN_INVOCATION_RECEIPT" \
+    --run-id "$DEVLYN_INVOCATION_RUN_ID" \
+    --phase "$DEVLYN_INVOCATION_PHASE" \
+    --round "$DEVLYN_INVOCATION_ROUND" \
+    --prompt-file "$DEVLYN_INVOCATION_PROMPT_FILE" \
+    --session-file "$DEVLYN_INVOCATION_SESSION_FILE" \
+    -- "${CODEX_ARGS[@]}" || exit 64
+fi
+
 # Launch codex with stdin closed; output streams directly to OUR stdout/stderr.
 set -m
 "$CODEX_BIN" exec "${CODEX_ARGS[@]}" < /dev/null &
 CODEX_PID=$!
-set +m
 printf '[codex-monitored] codex pid=%d\n' "$CODEX_PID" >&2
 
 heartbeat_loop "$CODEX_PID" &
@@ -231,21 +297,24 @@ if [ "$TIMEOUT_SEC" -gt 0 ]; then
   timeout_loop "$CODEX_PID" "$TIMEOUT_SEC" "$TIMEOUT_FLAG" &
   WATCHDOG_PID=$!
 fi
+set +m
 
 wait "$CODEX_PID"
 EXIT=$?
 terminate_process_group "$CODEX_PID" "post-exit-descendants"
-
-kill -TERM "$HB_PID" 2>/dev/null || true
-wait "$HB_PID" 2>/dev/null || true
-if [ -n "${WATCHDOG_PID:-}" ]; then
-  kill -TERM "$WATCHDOG_PID" 2>/dev/null || true
-  wait "$WATCHDOG_PID" 2>/dev/null || true
-fi
+CODEX_PID=""
+forward_signal TERM
 if [ -n "$TIMEOUT_FLAG" ] && [ -f "$TIMEOUT_FLAG" ]; then
   EXIT=124
 fi
 
+if [ -n "$RECEIPT_ENABLED" ]; then
+  python3 "$RECEIPT_HELPER" finish \
+    --workdir "$DEVLYN_INVOCATION_WORKDIR" \
+    --receipt "$DEVLYN_INVOCATION_RECEIPT" \
+    --exit-code "$EXIT" || exit 64
+fi
+
 printf '[codex-monitored] codex exited: code=%d elapsed=%ds\n' \
   "$EXIT" $(( $(date +%s) - START )) >&2
 exit "$EXIT"