okstra 0.163.2 → 0.165.0

package/runtime/bin/okstra-codex-exec.sh

@@ -1,471 +1,5 @@
 #!/usr/bin/env bash
-# okstra-codex-exec.sh — wrapper around `codex exec` for okstra codex-worker
-#
-# Purpose: Claude Code's Bash permission matcher requires explicit approval for
-# commands that contain shell metacharacters (stdin/stderr redirects, pipes).
-# `codex exec ... - < <prompt-path> 2>/dev/null` therefore triggers a permission
-# prompt every dispatch even when `Bash(codex exec:*)` is allowlisted, because
-# the redirect tokens disqualify the simple-prefix match.
-#
-# This wrapper accepts positional arguments and performs the redirect inside
-# the script body, so the caller can allowlist a single non-redirect form:
-#
-#   Bash($HOME/.okstra/bin/okstra-codex-exec.sh:*)
-#
-# Usage:
-#   okstra-codex-exec.sh <project-root> <model-execution-value> <prompt-path> [worktree-path] [role] [idle-timeout-seconds]
-#
-# project-root / model-execution-value / prompt-path are required.
-#
-# idle-timeout-seconds is optional (default 600s, or 1500s for the build-running
-# executor/verifier roles — see the role case below). When > 0, an
-# in-process watchdog polls the live-log mtime; if no stdout/stderr write
-# occurs for that many seconds, the underlying `codex exec` is SIGTERM'd
-# (then SIGKILL'd after a 5-second grace), the status sidecar gets a
-# `{timeout: true, idle_seconds, idle_at_ts, terminated_by: "idle-watchdog"}`
-# marker, and the wrapper exits non-zero. Pass `0` to disable. Default
-# exists because silent worker hangs are the dominant lead-time waste —
-# observed 28+25 minutes on hung claude-worker dispatches before manual
-# kill; a 10-minute cap costs ≤10m per hang while leaving long but live
-# runs untouched.
-#
-# worktree-path is optional and used for okstra implementation phase, where the
-# executor must mutate files inside a git worktree that lives outside
-# project-root. When supplied (non-empty), it is forwarded to codex as
-# `--add-dir <worktree-path>` so the codex sandbox grants write access to that
-# directory alongside the primary workspace anchored at project-root. When
-# omitted or empty, no `--add-dir` is added (existing analysis-phase behavior).
-#
-# role is optional and used only to label the auto-spawned tmux trace pane
-# (see "trace pane" section below). When omitted, it defaults to `worker`;
-# the dispatching agent passes it explicitly (always `worker`) per the
-# wrapper-invocation contract in agents/workers/_cli-wrapper-template.md.
-#
-# When role == `verifier`, the wrapper additionally grants the codex
-# `workspace-write` sandbox write access to `~/.cargo` and `~/.rustup` (when
-# they exist). Cargo's package-cache flock (`~/.cargo/.package-cache`) and
-# the registry/cache trees live OUTSIDE the workspace, so without these
-# extra `--add-dir` entries any `cargo build/test/clippy` invoked by the
-# verifier fails with `Resource temporarily unavailable` on the global
-# flock — which is the documented FU-V1 verifier-harness failure. Only the
-# `verifier` role gets this extension; other roles (`worker`, `executor`,
-# any custom label) keep the prior policy. Override per-role extras via the
-# `OKSTRA_CODEX_VERIFIER_EXTRA_DIRS` env var (colon-separated absolute
-# paths; empty disables the verifier extension entirely).
-#
-# For linked worktrees (the okstra implementation default), the per-worktree
-# git metadata (index, HEAD, refs) and the shared object database live in the
-# main repository's `.git` directory — OUTSIDE the worktree-path. Without
-# write access there, `git add` / `git commit` from inside the worktree fails
-# with EPERM on `.git/worktrees/<name>/index.lock`, which is the documented
-# failure pattern for linked-worktree commits under `workspace-write`. The
-# wrapper resolves the main repo's git-common-dir via `git rev-parse` against
-# the supplied worktree-path and forwards it as an additional `--add-dir`. If
-# resolution fails (not a linked worktree, or git unavailable), the extra
-# add-dir is silently omitted — the caller still gets the worktree add-dir
-# and any commit failure surfaces as a normal sandbox EPERM.
-#
-# The wrapper exits non-zero on any preflight failure.
 set -euo pipefail
 
-if [[ $# -lt 3 || $# -gt 6 ]]; then
-  printf 'usage: %s <project-root> <model-execution-value> <prompt-path> [worktree-path] [role] [idle-timeout-seconds]\n' "$(basename "$0")" >&2
-  exit 64
-fi
-
-project_root="$1"
-model="$2"
-prompt_path="$3"
-worktree_path="${4-}"
-role="${5:-worker}"
-# Implementation executor / verifier dispatches run whole build + test suites
-# that legitimately emit no stdout for many minutes; the 600s idle cap reaps
-# them mid-suite (observed: a silent jest + tsc build TERM'd at ~929s). Default
-# those roles to a longer idle cap that still sits below the 1800s wall-clock
-# polling cap so a genuine hang is reaped early. An explicit 6th arg wins.
-case "$role" in
-  executor | verifier) default_idle_timeout_secs=1500 ;;
-  *) default_idle_timeout_secs=600 ;;
-esac
-idle_timeout_secs="${6:-$default_idle_timeout_secs}"
-
-if ! [[ "$idle_timeout_secs" =~ ^[0-9]+$ ]]; then
-  printf 'okstra-codex-exec: idle-timeout-seconds must be a non-negative integer: %q\n' "$idle_timeout_secs" >&2
-  exit 69
-fi
-
-if [[ -z "$project_root" || ! -d "$project_root" ]]; then
-  printf 'okstra-codex-exec: project-root is missing or not a directory: %q\n' "$project_root" >&2
-  exit 65
-fi
-
-if [[ -z "$model" ]]; then
-  printf 'okstra-codex-exec: model-execution-value is empty\n' >&2
-  exit 66
-fi
-
-if [[ -z "$prompt_path" || ! -f "$prompt_path" ]]; then
-  printf 'okstra-codex-exec: prompt-path is missing or not a file: %q\n' "$prompt_path" >&2
-  exit 67
-fi
-
-if ! command -v codex >/dev/null 2>&1; then
-  printf 'okstra-codex-exec: codex CLI is not installed on PATH\n' >&2
-  exit 127
-fi
-
-if [[ -n "$worktree_path" && ! -d "$worktree_path" ]]; then
-  printf 'okstra-codex-exec: worktree-path was provided but is not a directory: %q\n' "$worktree_path" >&2
-  exit 68
-fi
-
-extra_args=()
-if [[ -n "$worktree_path" ]]; then
-  extra_args+=(--add-dir "$worktree_path")
-  # For linked worktrees, also open the main repo's `.git` so `git add` /
-  # `git commit` can write the per-worktree index/refs (under
-  # `.git/worktrees/<name>/`) and the shared object DB (`.git/objects/`).
-  # `--git-common-dir` resolves to the main repo's `.git` for any worktree
-  # (linked or main); for a main checkout it equals `<worktree>/.git` and is
-  # redundant-but-harmless. Failures (not-a-git-repo, git missing) are
-  # tolerated silently so analysis-phase callers stay unaffected.
-  if command -v git >/dev/null 2>&1; then
-    common_git_dir=$(git -C "$worktree_path" rev-parse --git-common-dir 2>/dev/null || true)
-    if [[ -n "$common_git_dir" ]]; then
-      # `rev-parse --git-common-dir` may return a path relative to the
-      # worktree; normalise to an absolute directory before forwarding.
-      if [[ "$common_git_dir" != /* ]]; then
-        common_git_dir="$worktree_path/$common_git_dir"
-      fi
-      if [[ -d "$common_git_dir" ]]; then
-        # Resolve `..` / symlinks so codex sees a canonical path.
-        common_git_dir=$(cd "$common_git_dir" && pwd -P)
-        extra_args+=(--add-dir "$common_git_dir")
-      fi
-    fi
-  fi
-fi
-
-# Verifier-role sandbox extension (see header comment for rationale).
-if [[ "$role" == "verifier" ]]; then
-  if [[ -n "${OKSTRA_CODEX_VERIFIER_EXTRA_DIRS+x}" ]]; then
-    verifier_extra_raw="$OKSTRA_CODEX_VERIFIER_EXTRA_DIRS"
-  else
-    verifier_extra_raw="${HOME}/.cargo:${HOME}/.rustup"
-  fi
-  if [[ -n "$verifier_extra_raw" ]]; then
-    IFS=':' read -r -a verifier_extra_dirs <<< "$verifier_extra_raw"
-    for verifier_dir in "${verifier_extra_dirs[@]}"; do
-      [[ -z "$verifier_dir" ]] && continue
-      if [[ -d "$verifier_dir" ]]; then
-        verifier_dir_abs=$(cd "$verifier_dir" && pwd -P)
-        extra_args+=(--add-dir "$verifier_dir_abs")
-      fi
-    done
-  fi
-fi
-
-# Derive a live-progress log path next to the prompt. The codex CLI streams
-# its progress over stdout/stderr, but the caller (codex-worker subagent)
-# only polls `BashOutput` on a 60s cadence — so without a sideband, a 10–30
-# minute implementation run produces no visible output until the very end.
-# Mirroring both streams into a file alongside the prompt lets the human
-# operator `tail -f <log-path>` from a separate pane and watch progress in
-# real time, and leaves a post-mortem record on disk regardless of how the
-# subagent renders the dispatch.
-log_path="${prompt_path%.md}.log"
-[[ "$log_path" == "$prompt_path" ]] && log_path="${prompt_path}.log"
-: > "$log_path"
-
-# Per-block line cap applied to the LOG COPY of codex's stdout (see
-# okstra_log_mirror below). Workers read their required inputs end-to-end per
-# templates/worker-prompt-preamble.md "Reading rules", so one report read can
-# dump 170KB+ into the log; observed sidecar logs reach 8MB and account for
-# ~93% of a project's `.okstra/` bytes (`okstra log-report` inventories them).
-# 120 lines keeps each block's command and the head of its output — enough to
-# reconstruct what ran — while cutting the whole-file dumps that dominate.
-log_block_line_cap=120
-
-# Mirror stdin to stdout verbatim AND to <log-path> with a per-block cap.
-#
-# Only the log copy is capped. The stdout passthrough is never filtered, so the
-# dispatching subagent's `BashOutput` still receives codex's output verbatim for
-# Phase 5 synthesis, and the model's own context is unaffected — the log is a
-# *copy* of output codex already produced, not an input to anything except a
-# human post-mortem and the `tail -n 10` diagnostic in
-# agents/workers/_cli-wrapper-template.md.
-#
-# A "block" starts at one of codex's own top-level markers. Misreading a marker
-# only resets the counter (less truncation); it can never drop a line from
-# stdout. The marker set is codex-specific — the claude wrapper emits
-# `--output-format=stream-json` and must NOT reuse this filter as-is.
-okstra_log_mirror() {
-  awk -v logf="$1" -v cap="$2" '
-    function drain() {
-      if (elided > 0) {
-        printf "  [okstra log-mirror] %d line(s) elided from this block\n", elided >> logf
-        fflush(logf)
-        elided = 0
-      }
-    }
-    /^(exec|codex|thinking|user)$/ { drain(); kept = 0 }
-    {
-      print
-      fflush()
-      kept++
-      if (kept <= cap) {
-        print >> logf
-        fflush(logf)
-      } else {
-        elided++
-        # Periodic drain keeps the log mtime moving: the idle watchdog below
-        # polls that mtime as its liveness proxy and would otherwise SIGTERM
-        # codex partway through a long elided block.
-        if (elided >= 500) drain()
-      }
-    }
-    END { drain(); close(logf) }
-  '
-}
-
-# stdout-mirror FIFO path (created at the dispatch block below). Declared here,
-# before the EXIT trap is defined, so the trap's cleanup reference is always set
-# under `set -u`.
-stdout_fifo=""
-
-# Heartbeat sidecar (`<prompt>.status.json`). The codex CLI streams progress
-# over stdout/stderr but the only structured signal the caller subagent
-# polls is `BashOutput`'s binary `running`/`completed` state. The sidecar
-# records `started_ts`, `pid`, `log_path` up-front and — via the EXIT trap
-# below — `exit_code`, `ended_ts`, `duration_ms` on termination. Two
-# consumers:
-#   1. `codex-worker` step 8c reads `log_path` to capture a diagnostic
-#      tail when `exit_code == 0` but no Result file was produced.
-#   2. Lead's redispatch policy distinguishes "wrapper never started"
-#      from "CLI ran but produced no artifact" via `stage`/`started_ts`.
-# Writes are best-effort; sidecar failures must NOT break the dispatch
-# (the underlying CLI run is the wrapper's primary job).
-status_path="${prompt_path}.status.json"
-started_ts=$(date +%s)
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
-# Trace-pane caller resolution helper (okstra_resolve_caller_pane). The lib dir
-# is a bin-sibling in both repo (scripts/lib/...) and installed
-# (~/.okstra/bin/lib/...) layouts; degrade silently if absent.
-[ -r "$script_dir/lib/okstra/tmux-pane.sh" ] && . "$script_dir/lib/okstra/tmux-pane.sh"
-python3 "$script_dir/okstra-wrapper-status.py" \
-  init "$status_path" "$(basename "$0")" "$role" "$$" "$started_ts" "$log_path" \
-  >>"$log_path" 2>&1 || true
-
-# Derive the okstra run dir from the prompt path. paths.py is the SSOT:
-# dispatched prompts live at `<RUN_DIR>/prompts/<cli>-worker-prompt<NNN>.md`,
-# so the run dir is two levels up. Used to tag the trace pane so cleanup can
-# find exactly this run's panes without any tmux env var. Empty if the
-# derivation fails — every dependent step below then degrades to a no-op.
-run_dir="$(cd "$(dirname "$prompt_path")/.." 2>/dev/null && pwd -P || true)"
-
-# Resolve the pane THIS wrapper actually runs in by walking our ancestor PIDs
-# and matching tmux pane_pids (see lib/okstra/tmux-pane.sh). Reliable
-# regardless of $TMUX/$TMUX_PANE (stripped by Claude Code's Bash tool) and of
-# which tmux client is currently active — a bare `tmux display-message` would
-# instead return the most-recently-active client's pane, frequently a DIFFERENT
-# session than the okstra run, which is why earlier approaches mis-placed or
-# dropped the trace pane. Empty = not inside a tmux pane (e.g. Claude launched
-# from the GUI app) → the trace split below is skipped.
-caller_pane=""
-if type okstra_resolve_caller_pane >/dev/null 2>&1; then
-  caller_pane="$(okstra_resolve_caller_pane)"
-fi
-
-# Pane titles: the caller (worker) pane gets `codex-<role>`; the sibling trace
-# pane is that same caller title with a `-tail` suffix, so the operator can
-# visually pair `<caller> ↔ <caller>-tail`. `role` carries the dispatched Agent
-# name minus the `codex-` prefix (e.g. `worker-reverify-r1`, `executor`), so the
-# pane title equals the FleetView teammate name instead of a generic `worker`.
-pane_label="codex-${role}"
-trace_label="${pane_label}-tail"
-
-# Capture the caller pane's current title so the EXIT trap can restore it
-# once the wrapper returns. Empty when not in tmux or capture fails — the
-# restore step degrades to a no-op in that case.
-original_caller_title=""
-if [[ -n "$caller_pane" ]]; then
-  original_caller_title=$(tmux display-message -p -t "$caller_pane" '#{pane_title}' 2>/dev/null || true)
-fi
-
-_okstra_status_finish() {
-  local exit_code=$?
-  local ended_ts
-  ended_ts=$(date +%s)
-  local duration_ms=$(( (ended_ts - started_ts) * 1000 ))
-  python3 "$script_dir/okstra-wrapper-status.py" \
-    finish "$status_path" "$exit_code" "$ended_ts" "$duration_ms" \
-    >>"$log_path" 2>&1 || true
-  if [[ -n "$caller_pane" && -n "$original_caller_title" ]]; then
-    tmux select-pane -t "$caller_pane" -T "$original_caller_title" 2>/dev/null || true
-  fi
-  [[ -n "$stdout_fifo" ]] && rm -f "$stdout_fifo" 2>/dev/null || true
-}
-trap _okstra_status_finish EXIT
-
-# Label the caller (worker) pane now that the restore trap is armed. Any
-# failure after this point still rewinds the title to its prior value.
-if [[ -n "$caller_pane" ]]; then
-  tmux select-pane -t "$caller_pane" -T "$pane_label" 2>/dev/null || true
-fi
-
-# When a tmux session is reachable, split a sibling pane that tails the live
-# log so the operator can watch codex's progress in real time without waiting
-# for the wrapper to exit. This fires in every phase the wrapper is invoked
-# from (analysis, error-analysis, implementation-planning, implementation,
-# …) — long-running codex dispatches are not implementation-specific. The
-# new pane carries the title `codex-<role>-tail` so the operator can
-# pair it with its caller pane (`codex-<role>`). The split is
-# explicitly anchored to the caller pane (`-t "$caller_pane"`) to avoid
-# attaching to tmux's idle active pane. `role` is the optional 5th
-# positional arg (defaults to `worker`); callers that dispatch a different
-# role (e.g. `executor`, `worker-reverify-r1`) must pass it explicitly so the
-# pane title names the actual job.
-# The pane uses `tail -F` (follow-by-name) so it survives any truncation a
-# re-dispatch performs on the same log path. We gate on a resolved
-# `$caller_pane` (non-empty only when tmux is reachable) rather than the
-# now-stripped `$TMUX`. Failures are tolerated silently: no tmux, a tmux
-# that refuses to split (size constraints, locked client), or a stale
-# socket all degrade to "log file is still on disk; the operator can tail
-# it manually from any terminal." The wrapper does NOT switch focus to the
-# new pane — control returns to the caller's pane via `tmux last-pane`.
-if [[ -n "$caller_pane" ]]; then
-  split_args=(-h -P -F '#{pane_id}' -c "$(dirname "$log_path")" -t "$caller_pane")
-  trace_pane=$(tmux split-window "${split_args[@]}" \
-    "tail -F $(printf '%q' "$log_path")" 2>/dev/null || true)
-  if [[ -n "$trace_pane" ]]; then
-    tmux select-pane -t "$trace_pane" -T "$trace_label" 2>/dev/null || true
-    # Tag the spawned pane with THIS run's dir so `okstra-trace-cleanup.sh
-    # --run-dir <RUN_DIR>` (see that script + `_common-contract.md`) can find
-    # and close exactly this run's trace panes — discovered server-wide by
-    # tag, needing no tmux env var, no pane-id registry, and no active-pane
-    # assumption. The run-scoped tag also stops concurrent okstra runs from
-    # stomping each other's trace panes.
-    [[ -n "$run_dir" ]] && tmux set-option -p -t "$trace_pane" @okstra_trace_run "$run_dir" 2>/dev/null || true
-    [[ -n "$status_path" ]] && tmux set-option -p -t "$trace_pane" @okstra_status "$status_path" 2>/dev/null || true
-    tmux last-pane 2>/dev/null || true
-  fi
-fi
-
-# stdin redirect, stderr capture, and pipeline mirroring are intentionally
-# inside the wrapper — this is the entire reason this script exists.
-#
-# stdout: mirrored to both the live log (for `tail -f`, capped per block by
-#         okstra_log_mirror) AND the wrapper's own stdout (verbatim, so the
-#         subagent's `BashOutput` still captures the final text for Phase 5
-#         synthesis). Implemented via a FIFO so codex itself stays a single
-#         addressable PID we can SIGTERM from the watchdog.
-# stderr: appended to the live log only — mirrors the prior `2>/dev/null`
-#         contract of keeping the wrapper's stderr stream clean.
-# exit:   codex's own exit code is preserved by `wait`.
-#
-# approval_policy=never: this wrapper runs codex fully non-interactively — stdin
-#   is the prompt file (EOF after it) and stdout/stderr are pipes (process
-#   substitution), not a TTY. Under codex's default `on-request` policy the agent
-#   BLOCKS on an approval prompt the instant it wants to act outside the
-#   workspace-write sandbox (e.g. read a sibling repo the prompt references); with
-#   no TTY to answer, codex ends the turn after a few seconds with exit 0 and NO
-#   model output — the silent empty-result failure this wrapper otherwise reports
-#   as a spurious success. `never` returns sandbox-escalation failures to the
-#   model instead of prompting, so the turn proceeds. The sandbox stays
-#   `workspace-write`: this removes the approval gate, not the sandbox. It is the
-#   codex-side equivalent of the antigravity wrapper's `--dangerously-skip-permissions`.
-# stdout must reach BOTH the live log and the wrapper's own stdout (so the
-# subagent's `BashOutput` captures the final text for Phase 5 synthesis). A
-# process substitution (`> >(tee …)`) does this, but bash opens the substituted
-# `/dev/fd/<n>` by pathname, and the macOS seatbelt sandbox wrapping a non-tmux
-# subagent's Bash tool denies that open (EPERM) — codex then never starts and
-# the wrapper exits with no output (the documented non-tmux dispatch failure). A
-# named FIFO is opened by an ordinary path under `.okstra/` (sandbox-writable),
-# so the mirror works in every dispatch context (real tmux pane OR sandboxed
-# subagent) while keeping codex a single addressable PID for the watchdog.
-stdout_fifo="${log_path}.stdout.fifo"
-rm -f "$stdout_fifo"
-mkfifo "$stdout_fifo"
-okstra_log_mirror "$log_path" "$log_block_line_cap" < "$stdout_fifo" &
-stdout_tee_pid=$!
-
-# Disable git's fsmonitor for every git command codex runs in this process
-# tree. The main worktree's fsmonitor daemon leaks its IPC socket into task
-# worktrees, so git status/commit here intermittently fail with
-# `fsmonitor_ipc__send_query` errors (workers otherwise recover by hand with
-# `git -c core.fsmonitor=false`). Injecting it via GIT_CONFIG_* scopes the
-# override to this process tree without touching the user's repo config, and
-# appends after any GIT_CONFIG_* the caller already set.
-_gc_idx="${GIT_CONFIG_COUNT:-0}"
-export "GIT_CONFIG_KEY_${_gc_idx}=core.fsmonitor"
-export "GIT_CONFIG_VALUE_${_gc_idx}=false"
-export GIT_CONFIG_COUNT="$(( _gc_idx + 1 ))"
-
-codex exec -C "$project_root" ${extra_args[@]+"${extra_args[@]}"} --model "$model" --sandbox workspace-write -c approval_policy=never - \
-  < "$prompt_path" \
-  2>> "$log_path" \
-  > "$stdout_fifo" &
-codex_pid=$!
-
-# Idle watchdog: poll the live log's mtime; if no write (stdout or stderr)
-# arrives for $idle_timeout_secs, SIGTERM codex, give it a 5-second grace,
-# then SIGKILL. Record the termination cause in the status sidecar so the
-# caller (lead) can distinguish "ran to completion with non-zero exit" from
-# "killed because it went silent". Set 0 to disable entirely.
-watchdog_pid=""
-if (( idle_timeout_secs > 0 )); then
-  poll_interval=$(( idle_timeout_secs / 20 ))
-  (( poll_interval < 5 )) && poll_interval=5
-  (( poll_interval > 30 )) && poll_interval=30
-  (
-    while kill -0 "$codex_pid" 2>/dev/null; do
-      sleep "$poll_interval"
-      kill -0 "$codex_pid" 2>/dev/null || exit 0
-      # Portable mtime probe: GNU (stat -c %Y) first, macOS/BSD (stat -f %m) as
-      # the fallback, 0 as the floor. Validate each result as a bare integer
-      # before accepting it — on Linux the BSD-ism `stat -f %m` does NOT fail
-      # cleanly; it succeeds and prints non-numeric filesystem output, which
-      # would break the arithmetic below under `set -u`.
-      #
-      # `|| true` is mandatory. macOS has no GNU `stat -c`, so that call exits 1,
-      # and `2>/dev/null` suppresses stderr but not the exit code. This watchdog
-      # is an explicit `( ) &` subshell, so it inherits whatever errexit setting
-      # is in force; under `set -e` a single failed assignment kills the whole
-      # watchdog on the first poll — silently, without a log line.
-      last_mtime="$(stat -c %Y "$log_path" 2>/dev/null || true)"
-      [[ "$last_mtime" =~ ^[0-9]+$ ]] || last_mtime="$(stat -f %m "$log_path" 2>/dev/null || true)"
-      [[ "$last_mtime" =~ ^[0-9]+$ ]] || last_mtime=0
-      now=$(date +%s)
-      idle=$(( now - last_mtime ))
-      if (( idle >= idle_timeout_secs )); then
-        printf '\n[okstra wrapper] idle-watchdog: %ds without stdout — terminating codex (pid=%d)\n' \
-          "$idle" "$codex_pid" >> "$log_path" 2>&1 || true
-        python3 "$script_dir/okstra-wrapper-status.py" \
-          timeout "$status_path" "$now" "$idle" >>"$log_path" 2>&1 || true
-        kill -TERM "$codex_pid" 2>/dev/null || true
-        sleep 5
-        kill -KILL "$codex_pid" 2>/dev/null || true
-        exit 0
-      fi
-    done
-  ) &
-  watchdog_pid=$!
-fi
-
-set +e
-wait "$codex_pid"
-codex_exit=$?
-set -e
-
-if [[ -n "$watchdog_pid" ]]; then
-  kill "$watchdog_pid" 2>/dev/null || true
-  wait "$watchdog_pid" 2>/dev/null || true
-fi
-
-# Drain the stdout-mirror tee so the final lines reach the live log and the
-# caller's stdout before exit. codex's closed write end gives the tee EOF; then
-# remove the FIFO (the EXIT trap also clears it on an abnormal exit).
-wait "$stdout_tee_pid" 2>/dev/null || true
-rm -f "$stdout_fifo"
-
-exit "$codex_exit"
+exec python3 "$script_dir/okstra-provider-exec.py" codex "$@"