orkestrator 2.26.0-alpha → 2.26.1-alpha

package/resources/codex-bridge/dist/index.js

@@ -3984,11 +3984,6 @@ var LEGACY_ENABLED_AGENT_PLATFORMS = Object.freeze([
 // ../protocol/src/native-agent-transcript-patch.ts
 var FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
-// ../protocol/src/native-agent-policy-effects.ts
-function appendNativeAgentPolicyNote(policy, note) {
-  return { ...policy, note: policy.note ? `${policy.note} ${note}` : note };
-}
-
 // ../protocol/src/native-agent-steer-rejection.ts
 var MAX_STEER_JOURNAL_BYTES = 1024 * 1024 * 1024;
 // ../protocol/src/native-agent.ts
@@ -17200,7 +17195,7 @@ function reduceHistoricalTurns(turns, generation, threadId, handle) {
   return { events, unsupportedItemTypes };
 }
 
-// ../../bridges/codex-bridge/src/app-server/redaction.ts
+// ../protocol/src/secret-redaction.ts
 var TEXT_RULES = [
   {
     pattern: /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+(?::[^/\s@]*)?@/gi,
@@ -18023,6 +18018,7 @@ function coordinatorCapabilityPolicy(mode) {
 }
 
 // ../../bridges/codex-bridge/src/codex-config.ts
+import { realpathSync } from "node:fs";
 import { isAbsolute as isAbsolute5 } from "node:path";
 var CODEX_MAX_CONCURRENT_THREADS_ENV = "CODEX_MAX_CONCURRENT_THREADS_PER_SESSION";
 var DEFAULT_CODEX_MAX_CONCURRENT_THREADS = 5;
@@ -18042,6 +18038,43 @@ function codexNetworkDeniedConfig(policy) {
     "features.standalone_web_search": false
   };
 }
+function codexProjectTrustConfig(policy, cwd) {
+  if (!policy || policy.projectResources || !cwd || !isAbsolute5(cwd))
+    return {};
+  const roots = new Set([cwd]);
+  try {
+    roots.add(realpathSync(cwd));
+  } catch {}
+  return {
+    projects: Object.fromEntries([...roots].map((root) => [root, { trust_level: "untrusted" }]))
+  };
+}
+var MAX_CODEX_DISABLED_SKILLS = 1024;
+var KEPT_SKILL_SCOPES = new Set(["user", "system", "admin"]);
+function codexProjectSkillsConfig(listed) {
+  const data = listed && typeof listed === "object" && Array.isArray(listed.data) ? listed.data : undefined;
+  if (!data)
+    throw new Error("Codex skills/list returned no skill inventory");
+  const disabled = new Set;
+  for (const entry of data) {
+    const skills = entry?.skills;
+    for (const skill of Array.isArray(skills) ? skills : []) {
+      const { path, scope, enabled } = skill ?? {};
+      if (enabled === true && typeof scope === "string" && KEPT_SKILL_SCOPES.has(scope))
+        continue;
+      if (typeof path !== "string" || !isAbsolute5(path)) {
+        throw new Error("Codex listed a project skill without a path it can be disabled by");
+      }
+      disabled.add(path);
+    }
+  }
+  if (disabled.size > MAX_CODEX_DISABLED_SKILLS) {
+    throw new Error(`Codex listed more than ${MAX_CODEX_DISABLED_SKILLS} skills to disable`);
+  }
+  if (disabled.size === 0)
+    return {};
+  return { skills: { config: [...disabled].map((path) => ({ path, enabled: false })) } };
+}
 var READ_ONLY_TURN_FALLBACK_POLICY = Object.freeze({
   id: "interactive-host",
   sandbox: "provider",
@@ -18537,6 +18570,8 @@ function mcpFailureReason(notice) {
   return reason || undefined;
 }
 var MAX_SKILL_LOAD_NOTICES = 16;
+var MCP_STATUS_PAGE_SIZE = 100;
+var MCP_STATUS_MAX_PAGES = 10;
 function skillPathFingerprint(path) {
   let hash = 2166136261;
   for (let index = 0;index < path.length; index += 1) {
@@ -19063,10 +19098,30 @@ class AppServerEngine {
     }
     throw new Error("Codex model catalogue exceeded its page limit");
   }
-  toThreadParams(config) {
+  async projectResourceThreadConfig(generation, config) {
+    if (!config.policy || config.policy.projectResources)
+      return {};
+    let listed;
+    try {
+      listed = await this.supervisor.requestOnGeneration(generation, "skills/list", {
+        cwds: [config.cwd ?? this.options.cwd],
+        forceReload: true
+      });
+    } catch (error) {
+      if (error instanceof AppServerRpcError && error.code === JSON_RPC_METHOD_NOT_FOUND) {
+        throw new Error("Codex cannot enforce disabled project resources without skills/list");
+      }
+      throw error;
+    }
+    return codexProjectSkillsConfig(listed);
+  }
+  toThreadParams(config, extraConfig = {}) {
     const approveAgentMcpTools = config.policy?.approvals === "auto-approve" && (config.approvalPolicy ?? "never") === "never" && config.sandbox !== "read-only" || config.policy?.id === "coordinator-read-only" && Boolean(config.permissionProfile) || Boolean(config.workflowResultTool && config.agentMcp);
+    const cwd = config.cwd ?? this.options.cwd;
     const threadConfig = {
       ...codexNetworkDeniedConfig(config.policy),
+      ...codexProjectTrustConfig(config.policy, cwd),
+      ...extraConfig,
       ...config.agentMcp ? {
         ...config.agentMcp.design ? {
           "mcp_servers.orkestrator-design": {
@@ -19095,7 +19150,7 @@ class AppServerEngine {
       } : {}
     };
     return {
-      cwd: config.cwd ?? this.options.cwd,
+      cwd,
       approvalPolicy: config.approvalPolicy ?? "never",
       approvalsReviewer: config.approvalsReviewer ?? "user",
       ...config.permissionProfile ? {} : {
@@ -19126,13 +19181,15 @@ class AppServerEngine {
   }
   async startThread(options) {
     const generation = await this.assertHostedNetworkLock(options.config);
-    const response = await this.supervisor.requestOnGeneration(generation, "thread/start", this.toThreadParams(options.config));
+    const extra = await this.projectResourceThreadConfig(generation, options.config);
+    const response = await this.supervisor.requestOnGeneration(generation, "thread/start", this.toThreadParams(options.config, extra));
     this.assertPermissionProfile(response.activePermissionProfile, options.config);
     return this.bindThread(response.thread, options.config, response.model);
   }
   async resumeThread(threadId, options) {
     const generation = await this.assertHostedNetworkLock(options.config);
-    const response = await this.supervisor.requestOnGeneration(generation, "thread/resume", { threadId, ...this.toThreadParams(options.config) });
+    const extra = await this.projectResourceThreadConfig(generation, options.config);
+    const response = await this.supervisor.requestOnGeneration(generation, "thread/resume", { threadId, ...this.toThreadParams(options.config, extra) });
     this.assertPermissionProfile(response.activePermissionProfile, options.config);
     const thread = this.bindThread(response.thread, options.config, response.model);
     thread.turns = this.extractTurns(response.thread);
@@ -19150,10 +19207,11 @@ class AppServerEngine {
   }
   async forkThread(threadId, config, lastTurnId) {
     const generation = await this.assertHostedNetworkLock(config);
+    const extra = await this.projectResourceThreadConfig(generation, config);
     const response = await this.supervisor.requestOnGeneration(generation, "thread/fork", {
       threadId,
       ...lastTurnId ? { lastTurnId } : {},
-      ...this.toThreadParams(config)
+      ...this.toThreadParams(config, extra)
     });
     this.assertPermissionProfile(response.activePermissionProfile, config);
     return this.bindThread(response.thread, config, response.model);
@@ -19193,11 +19251,7 @@ class AppServerEngine {
   }
   async getRuntimeHealth(threadId) {
     const [mcp, skills, hooks, rateLimits] = await Promise.allSettled([
-      this.supervisor.request("mcpServerStatus/list", {
-        limit: 100,
-        detail: "full",
-        ...threadId ? { threadId } : {}
-      }),
+      this.listMcpServerStatus(threadId),
       this.supervisor.request("skills/list", {
         cwds: [this.options.cwd]
       }),
@@ -19260,12 +19314,29 @@ class AppServerEngine {
       rateLimits: allowlistRateLimits(rateLimitValue)
     };
   }
+  async listMcpServerStatus(threadId) {
+    const data = [];
+    let cursor;
+    let last = {};
+    for (let page = 0;page < MCP_STATUS_MAX_PAGES; page += 1) {
+      const response = await this.supervisor.request("mcpServerStatus/list", {
+        ...cursor ? { cursor } : {},
+        limit: MCP_STATUS_PAGE_SIZE,
+        detail: "full",
+        ...threadId ? { threadId } : {}
+      });
+      last = objectRecord(response);
+      if (!Array.isArray(last.data))
+        return page === 0 ? response : { ...last, data };
+      data.push(...last.data);
+      cursor = typeof last.nextCursor === "string" && last.nextCursor ? last.nextCursor : undefined;
+      if (!cursor)
+        break;
+    }
+    return { ...last, data };
+  }
   async listMcpServers(threadId) {
-    const response = await this.supervisor.request("mcpServerStatus/list", {
-      limit: 100,
-      detail: "full",
-      ...threadId ? { threadId } : {}
-    });
+    const response = await this.listMcpServerStatus(threadId);
     const root = objectRecord(response);
     if (!Array.isArray(root.data))
       return response;
@@ -19489,18 +19560,24 @@ class AppServerEngine {
   rolloutPath(threadId) {
     return this.rolloutPaths.get(threadId);
   }
-  async unsubscribeThread(handle) {
+  async unsubscribeThread(handle, requireConfirmation = false) {
     const binding = this.bindings.get(handle);
-    this.accountProofTurns.delete(binding?.threadId ?? handle);
-    this.rolloutPaths.delete(binding?.threadId ?? handle);
-    this.bindings.delete(handle);
-    if (!binding)
+    const threadId = binding?.threadId ?? handle;
+    if (!binding && !requireConfirmation) {
+      this.accountProofTurns.delete(threadId);
+      this.rolloutPaths.delete(threadId);
       return;
+    }
     try {
-      await this.supervisor.request("thread/unsubscribe", { threadId: binding.threadId });
+      await this.supervisor.request("thread/unsubscribe", { threadId });
     } catch (error) {
+      if (requireConfirmation)
+        throw error;
       console.warn("[codex-bridge] thread/unsubscribe failed:", error instanceof Error ? error.message : error);
     }
+    this.accountProofTurns.delete(threadId);
+    this.rolloutPaths.delete(threadId);
+    this.bindings.delete(handle);
   }
   async configureThread(handle, config) {
     const binding = this.bindings.get(handle);
@@ -20013,14 +20090,6 @@ class ThreadRegistry {
   }
 }
 
-// ../../bridges/codex-bridge/src/codex-reported-policy.ts
-var CODEX_PROJECT_TRUST_NOTE = "Codex loads a trusted project's own configuration, including its MCP servers and hooks, whatever this session's policy says.";
-function codexReportedPolicy(policy) {
-  if (policy.projectResources || policy.id === "coordinator-read-only")
-    return policy;
-  return appendNativeAgentPolicyNote({ ...policy, projectResources: true }, CODEX_PROJECT_TRUST_NOTE);
-}
-
 // ../../bridges/codex-bridge/src/app-server-runtime-sessions.ts
 var SESSION_CLOSING_ERROR = "Session is closing";
 
@@ -20720,14 +20789,25 @@ class CodexRuntimeSessions {
         if (requestedModelChanged)
           attached.modelId = undefined;
         await this.ctx.options.engine.configureThread(attached.engineHandle, nextConfig);
+        if (session.config.policy?.projectResources !== nextConfig.policy?.projectResources || (session.config.cwd ?? this.ctx.options.cwd) !== (nextConfig.cwd ?? this.ctx.options.cwd)) {
+          await this.lifecycle.detachThread(attached, true);
+        }
       }
     } catch (error) {
+      if (attached) {
+        await this.ctx.options.engine.configureThread(attached.engineHandle, session.config).catch(() => {
+          return;
+        });
+      }
       if (attached && requestedModelChanged) {
         attached.modelId = previousConfirmedModel;
       }
       console.warn(`[codex-bridge] Could not apply configuration for session ${sessionId}:`, error instanceof Error ? error.message : error);
       return "unavailable";
     }
+    if (session.config.policy?.projectResources !== nextConfig.policy?.projectResources) {
+      this.ctx.commandCatalogue.markPolicyChanged();
+    }
     session.config = nextConfig;
     session.configurationRevision += 1;
     this.ctx.registry.touch(sessionId);
@@ -20818,7 +20898,7 @@ class CodexRuntimeSessions {
     const error = context?.error ?? (phase === "failed" && session.restartFailure ? CODEX_RESTARTED_MID_TURN_MESSAGE : undefined);
     return {
       status: phaseToExternalStatus(phase),
-      ...session.config.policy ? { policy: codexReportedPolicy(session.config.policy) } : {},
+      ...session.config.policy ? { policy: session.config.policy } : {},
       phase,
       title: session.title,
       error,
@@ -21003,7 +21083,7 @@ class CodexRuntimeSessions {
       ...session.config.reasoningEffort ? { modelReasoningEffort: session.config.reasoningEffort } : {},
       mode: session.config.mode,
       fastMode: session.config.serviceTier === "fast",
-      ...session.config.policy ? { policy: codexReportedPolicy(session.config.policy) } : {},
+      ...session.config.policy ? { policy: session.config.policy } : {},
       durable: await this.isSessionConfigPersisted(session)
     };
   }
@@ -21855,7 +21935,13 @@ function normalizeSkillsList(raw, context) {
     fetchedAt: context.now
   };
 }
-function skillUnavailability(binding) {
+function skillUnavailability(binding, projectResources = true) {
+  if (!projectResources && !["user", "system", "admin"].includes(binding.scope)) {
+    return {
+      reason: "disabled",
+      message: "This skill is disabled because project resources are off for this session."
+    };
+  }
   if (!binding.enabled) {
     return {
       reason: "disabled",
@@ -21870,8 +21956,8 @@ function skillUnavailability(binding) {
   }
   return;
 }
-function skillCommandRow(binding) {
-  const unavailable = skillUnavailability(binding);
+function skillCommandRow(binding, projectResources = true) {
+  const unavailable = skillUnavailability(binding, projectResources);
   return {
     name: `$${binding.name}`,
     insertText: `$${binding.name}`,
@@ -22065,7 +22151,10 @@ class CodexCommandCatalogue {
       onRefreshed: (read) => {
         this.skillsDigest = commandBindingRevision([
           String(read.fresh),
-          read.snapshot ? JSON.stringify([read.snapshot.truncated, read.snapshot.bindings.map(skillCommandRow)]) : "none"
+          read.snapshot ? JSON.stringify([
+            read.snapshot.truncated,
+            read.snapshot.bindings.map((binding) => skillCommandRow(binding))
+          ]) : "none"
         ]);
         this.bumpIfChanged();
       }
@@ -22083,6 +22172,9 @@ class CodexCommandCatalogue {
     this.compositeDigest = composite;
     this.revisionValue += 1;
   }
+  markPolicyChanged() {
+    this.revisionValue += 1;
+  }
   markSkillsChanged() {
     this.skills.markChanged();
   }
@@ -22109,7 +22201,7 @@ class CodexCommandCatalogue {
     const templates = await this.scanTemplates();
     return [...BUILTINS.map(builtinRow), ...templates.effective.map(templateCommandRow)];
   }
-  async collect() {
+  async collect(projectResources = true) {
     this.deferredBumps += 1;
     let templates;
     let skillRead;
@@ -22122,7 +22214,7 @@ class CodexCommandCatalogue {
     const candidates = [
       ...BUILTINS.map(builtinRow),
       ...templates.effective.map(templateCommandRow),
-      ...skillRead.snapshot?.bindings.map(skillCommandRow) ?? []
+      ...skillRead.snapshot?.bindings.map((binding) => skillCommandRow(binding, projectResources)) ?? []
     ];
     const commands = [];
     let bytes = 0;
@@ -22144,8 +22236,8 @@ class CodexCommandCatalogue {
       skills: skillRead.snapshot
     };
   }
-  async list() {
-    const collected = await this.collect();
+  async list(projectResources = true) {
+    const collected = await this.collect(projectResources);
     this.listedTemplates = new Map(collected.templates.effective.map((entry) => [entry.id, entry.fingerprint]));
     return {
       catalogueVersion: NATIVE_AGENT_COMMAND_CATALOGUE_VERSION,
@@ -22167,7 +22259,7 @@ class CodexCommandCatalogue {
     }
     return { outcome: "reloaded" };
   }
-  async resolveSelected(command) {
+  async resolveSelected(command, projectResources = true) {
     const stale = (name) => ({
       kind: "refused",
       message: `${name} changed since it was selected. Choose it again from the menu.`
@@ -22228,7 +22320,11 @@ class CodexCommandCatalogue {
       const binding = read.snapshot.byId.get(command.id);
       if (!binding)
         return this.unknownSelection();
-      return checkRow(skillCommandRow(binding)) ?? { kind: "skill", binding, args: command.arguments };
+      return checkRow(skillCommandRow(binding, projectResources)) ?? {
+        kind: "skill",
+        binding,
+        args: command.arguments
+      };
     }
     return this.unknownSelection();
   }
@@ -22238,7 +22334,21 @@ class CodexCommandCatalogue {
       message: "The selected command is no longer available. Choose it again from the menu."
     };
   }
-  async resolveTyped(prompt) {
+  async resolveTyped(prompt, projectResources = true) {
+    if (!projectResources) {
+      const mention = parseCommandToken(prompt, ["$"]);
+      if (mention) {
+        const read = await this.skills.read();
+        if (!read.fresh)
+          return { kind: "refused", message: "Codex skills could not be verified." };
+        const binding = read.snapshot?.bindings.find((candidate) => `$${candidate.name}` === mention.token);
+        if (binding) {
+          const unavailable = skillUnavailability(binding, projectResources);
+          if (unavailable)
+            return { kind: "refused", message: unavailable.message };
+        }
+      }
+    }
     const token = parseCommandToken(prompt, ["/"]);
     if (!token)
       return { kind: "text" };
@@ -22247,7 +22357,7 @@ class CodexCommandCatalogue {
     if (builtin)
       return { kind: "builtin", builtin: builtin.kind };
     if (typed.toLowerCase().startsWith(SKILL_ALIAS_PREFIX)) {
-      return this.resolveTypedSkill(typed, token.arguments);
+      return this.resolveTypedSkill(typed, token.arguments, projectResources);
     }
     const scan = await this.scanTemplates();
     const matches = matchByPrecedence(scan.effective, (entry) => [entry.displayName], typed);
@@ -22264,7 +22374,7 @@ class CodexCommandCatalogue {
       return { kind: "refused", message: entry.problem.message };
     return { kind: "template", entry, args: token.arguments };
   }
-  async resolveTypedSkill(typed, args) {
+  async resolveTypedSkill(typed, args, projectResources) {
     const read = await this.skills.read();
     if (!read.snapshot) {
       return {
@@ -22286,7 +22396,7 @@ class CodexCommandCatalogue {
       };
     }
     const binding = matches[0];
-    const unavailable = skillUnavailability(binding);
+    const unavailable = skillUnavailability(binding, projectResources);
     if (unavailable)
       return { kind: "refused", message: unavailable.message };
     return { kind: "skill", binding, args };
@@ -22297,8 +22407,8 @@ class CodexCommandCatalogue {
       return loaded;
     return expandTemplateArguments(loaded.body, args, TEMPLATE_LIMITS.maxExpandedBytes);
   }
-  async helpText() {
-    const collected = await this.collect();
+  async helpText(projectResources = true) {
+    const collected = await this.collect(projectResources);
     const lines = ["Available Codex slash commands:"];
     const describe = (row, label) => {
       const hint = row.argumentHint ? ` ${row.argumentHint}` : "";
@@ -22402,6 +22512,7 @@ class CodexRuntimeContext {
   transcriptHydrateInFlight = new Map;
   steerRequests = new Map;
   commandCatalogue;
+  projectSkillsRevision = 0;
   accountRateLimits = [];
   accountCredits;
   closingSessionIds = new Set;
@@ -22461,6 +22572,8 @@ function promptThreadConfig(config) {
       config.permissionProfile,
       config.workflowResultTool
     ] : [],
+    config.policy?.projectResources,
+    config.cwd,
     codexNetworkDeniedConfig(config.policy)
   ]);
 }
@@ -22767,7 +22880,7 @@ class CodexRuntimeLifecycle {
           return;
         }
         const lastMessage = context.messages.at(-1);
-        const assistantMessage = lastMessage?.role === "assistant" ? lastMessage : {
+        const assistantMessage = lastMessage?.role === "assistant" && !lastMessage.content && (lastMessage.parts?.length ?? 0) === 0 ? lastMessage : {
           id: createMessageId(),
           role: "assistant",
           content: "",
@@ -22817,7 +22930,11 @@ class CodexRuntimeLifecycle {
     }
     return { detached, forgotten };
   }
-  async detachThread(context) {
+  async detachThread(context, requireUnsubscribe = false) {
+    if (requireUnsubscribe) {
+      context.promptThreadConfig = undefined;
+      await this.ctx.options.engine.unsubscribeThread(context.engineHandle, true);
+    }
     const sessionIds = [...context.bridgeSessionIds];
     this.releaseThreadRuntimeState(context.threadId);
     this.ctx.registry.detachThread(context.threadId);
@@ -22831,9 +22948,11 @@ class CodexRuntimeLifecycle {
       }));
     }
     this.ctx.detachedThreads += 1;
-    await this.ctx.options.engine.unsubscribeThread(context.engineHandle).catch(() => {
-      return;
-    });
+    if (!requireUnsubscribe) {
+      await this.ctx.options.engine.unsubscribeThread(context.engineHandle).catch(() => {
+        return;
+      });
+    }
   }
   releaseThreadRuntimeState(threadId) {
     const timer = this.ctx.recoveryBackstops.get(threadId);
@@ -23031,6 +23150,7 @@ class CodexRuntimeLifecycle {
       return;
     }
     if (event.kind === "skills.changed") {
+      this.ctx.projectSkillsRevision += 1;
       this.ctx.commandCatalogue.markSkillsChanged();
       return;
     }
@@ -24253,7 +24373,7 @@ class CodexRuntimePrompt {
     const interpretCommands = input.allowProviderCommands !== false;
     let plan;
     if (input.command) {
-      plan = await this.ctx.commandCatalogue.resolveSelected(input.command);
+      plan = await this.ctx.commandCatalogue.resolveSelected(input.command, session.config.policy?.projectResources !== false);
       if (plan.kind === "refused")
         return commandRefusal(plan.message);
       if (plan.kind === "builtin" && input.outputSchema) {
@@ -24289,22 +24409,19 @@ class CodexRuntimePrompt {
     context = await this.ctx.callbacks.ensureAttached(session.id);
     this.ctx.registry.assertNoActiveTurn(context);
     if (!plan) {
-      plan = interpretCommands && !input.outputSchema ? await this.ctx.commandCatalogue.resolveTyped(input.prompt) : { kind: "text" };
+      plan = interpretCommands && !input.outputSchema ? await this.ctx.commandCatalogue.resolveTyped(input.prompt, session.config.policy?.projectResources !== false) : { kind: "text" };
     } else if (plan.kind === "skill") {
-      const live = this.ctx.commandCatalogue.skills.current()?.byId.get(plan.binding.id);
-      if (!live || live.path !== plan.binding.path || !live.enabled || live.ambiguous) {
-        const revalidated = await this.ctx.commandCatalogue.resolveSelected(input.command);
-        if (revalidated.kind === "refused")
-          return commandRefusal(revalidated.message);
-        plan = revalidated;
-      }
+      const revalidated = await this.ctx.commandCatalogue.resolveSelected(input.command, session.config.policy?.projectResources !== false);
+      if (revalidated.kind === "refused")
+        return commandRefusal(revalidated.message);
+      plan = revalidated;
     }
     if (plan.kind === "refused") {
       this.emitLocalResponse(session, input.prompt, plan.message);
       return { ok: true, result: { status: "processing", requestId } };
     }
     if (plan.kind === "builtin") {
-      const response = plan.builtin === "help" ? await this.ctx.commandCatalogue.helpText() : await this.modelsListText(session);
+      const response = plan.builtin === "help" ? await this.ctx.commandCatalogue.helpText(session.config.policy?.projectResources !== false) : await this.modelsListText(session);
       this.emitLocalResponse(session, input.prompt, response);
       return { ok: true, result: { status: "processing", requestId } };
     }
@@ -24323,6 +24440,11 @@ class CodexRuntimePrompt {
       executionPrompt = `$${plan.binding.name}${plan.args ? ` ${plan.args}` : ""}`;
       skillInput = { name: plan.binding.name, path: plan.binding.path };
     }
+    if (plan.kind === "skill") {
+      const unavailable = skillUnavailability(plan.binding, session.config.policy?.projectResources !== false);
+      if (unavailable)
+        return commandRefusal(unavailable.message);
+    }
     const isPlanReview = session.config.mode === "plan";
     const promptConfig = () => ({
       ...session.config,
@@ -24336,7 +24458,8 @@ class CodexRuntimePrompt {
       } : {},
       ...input.workflowResultTool ? { workflowResultTool: input.workflowResultTool } : {}
     });
-    const needsThreadReload = (config) => Boolean(input.workflowResultTool) || context?.promptThreadConfig !== promptThreadConfig(config);
+    let projectSkillsRevision = this.ctx.projectSkillsRevision;
+    const needsThreadReload = (config) => Boolean(input.workflowResultTool) || context?.promptThreadConfig !== promptThreadConfig(config) || config.policy?.projectResources === false && context?.projectSkillsRevision !== projectSkillsRevision;
     if (context && !context.materialized && needsThreadReload(promptConfig())) {
       await this.lifecycle.detachThread(context);
       context = undefined;
@@ -24370,7 +24493,28 @@ class CodexRuntimePrompt {
     if (hadAttachedContext && needsThreadReload(turnConfig)) {
       context = await this.resumeThreadForPrompt(session.id, context, turnConfig);
     }
+    for (let attempt = 0;turnConfig.policy?.projectResources === false && projectSkillsRevision !== this.ctx.projectSkillsRevision; attempt += 1) {
+      if (attempt >= 3) {
+        context.promptThreadConfig = undefined;
+        return {
+          ok: false,
+          status: 503,
+          error: "Codex project skills kept changing; retry when the inventory settles"
+        };
+      }
+      if (!context.materialized) {
+        await this.lifecycle.detachThread(context, true);
+        return {
+          ok: false,
+          status: 503,
+          error: "Codex project skills changed during attachment; retry the prompt"
+        };
+      }
+      projectSkillsRevision = this.ctx.projectSkillsRevision;
+      context = await this.resumeThreadForPrompt(session.id, context, turnConfig);
+    }
     context.promptThreadConfig = promptThreadConfig(turnConfig);
+    context.projectSkillsRevision = projectSkillsRevision;
     if (input.workflowResultTool && turnConfig.agentMcp) {
       const availability = await this.ctx.options.engine.workflowResultToolAvailability(context.threadId, input.workflowResultTool);
       if (availability.state === "missing") {
@@ -24553,6 +24697,7 @@ class CodexRuntimePrompt {
           context = await this.resumeThreadForPrompt(session.id, context, turnConfig);
         }
         context.promptThreadConfig = promptThreadConfig(turnConfig);
+        context.projectSkillsRevision = projectSkillsRevision;
         context.dispatchInFlight = true;
         this.ctx.registry.setPhase(context, "starting");
         if (context !== staleContext) {
@@ -24946,7 +25091,7 @@ class CodexRuntimePrompt {
         commands: []
       };
     }
-    return this.ctx.commandCatalogue.list();
+    return this.ctx.commandCatalogue.list(this.ctx.registry.getSession(sessionId)?.config.policy?.projectResources !== false);
   }
   async refreshCommandCatalogue(sessionId) {
     if (!this.ctx.registry.getSession(sessionId)) {
@@ -27240,7 +27385,5 @@ export {
   REPLAY_IDLE_RETENTION_MS,
   __testing,
   app,
-  boundCodexTranscriptResponse,
-  itemToParts,
-  stringifyUnknown
+  boundCodexTranscriptResponse
 };