skill-codex 0.2.0 → 0.7.1

package/dist/index.js

@@ -7,8 +7,8 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 
 // src/tools/codex-exec.ts
-import fs2 from "fs";
-import path3 from "path";
+import fs3 from "fs";
+import path4 from "path";
 import { z } from "zod";
 
 // src/errors/errors.ts
@@ -126,9 +126,10 @@ var NotGitRepoError = class extends BridgeError {
 // src/config/constants.ts
 var MAX_BRIDGE_DEPTH = 2;
 var BRIDGE_DEPTH_ENV = "SKILL_CODEX_DEPTH";
-var DEFAULT_TIMEOUT_MS = 6e5;
+var DEFAULT_TIMEOUT_MS = 3e5;
 var TIMEOUT_ENV = "SKILL_CODEX_TIMEOUT_MS";
 var KILL_GRACE_MS = 5e3;
+var HEARTBEAT_INTERVAL_MS = 1e4;
 var MAX_RETRIES = 3;
 var MAX_RETRIES_ENV = "SKILL_CODEX_MAX_RETRIES";
 var RETRY_DELAYS_MS = [1e3, 2e3, 4e3];
@@ -136,6 +137,9 @@ var RETRY_CAP_MS = 1e4;
 var MAX_RESPONSE_CHARS = 8e4;
 var LOCK_STALE_MS = 9e5;
 var LOCK_FILENAME = ".skill-codex.lock";
+var LOG_ENV = "SKILL_CODEX_LOG";
+var WINDOWS_SANDBOX_ENV = "SKILL_CODEX_WINDOWS_SANDBOX";
+var WINDOWS_SANDBOX_DEFAULT = "unelevated";
 
 // src/guards/check-recursion.ts
 function getCurrentDepth() {
@@ -172,6 +176,16 @@ async function checkBinary(binary = "codex") {
 
 // src/guards/check-auth.ts
 import { execFile } from "child_process";
+
+// src/runner/sandbox-args.ts
+function getSandboxConfigArgs() {
+  if (process.platform !== "win32") return [];
+  const raw = process.env[WINDOWS_SANDBOX_ENV]?.trim() || WINDOWS_SANDBOX_DEFAULT;
+  const mode = /^[a-z-]+$/.test(raw) ? raw : WINDOWS_SANDBOX_DEFAULT;
+  return ["-c", `windows.sandbox=${mode}`];
+}
+
+// src/guards/check-auth.ts
 var AUTH_CACHE_TTL_MS = 6e4;
 var authCachedAt = null;
 async function checkAuth() {
@@ -183,8 +197,8 @@ async function checkAuth() {
   return new Promise((resolve, reject) => {
     const child = execFile(
       binary,
-      ["exec", "--sandbox", "read-only", "--skip-git-repo-check", "--ephemeral", "echo ok"],
-      { timeout: 15e3 },
+      ["exec", "--sandbox", "read-only", ...getSandboxConfigArgs(), "--skip-git-repo-check", "--ephemeral", "echo ok"],
+      { timeout: 3e4, shell: process.platform === "win32" },
       (error, _stdout, stderr) => {
         if (!error) {
           authCachedAt = Date.now();
@@ -322,7 +336,7 @@ function checkGit(cwd) {
 async function runPreflight(options) {
   checkRecursion();
   await checkBinary();
-  if (!options.skipAuth) {
+  if (!options.skipAuth && process.platform !== "win32") {
     await checkAuth();
   }
   let lockHandle = null;
@@ -341,6 +355,7 @@ async function runPreflight(options) {
 
 // src/runner/exec-runner.ts
 import { spawn } from "child_process";
+import { StringDecoder } from "string_decoder";
 
 // src/util/platform.ts
 import os2 from "os";
@@ -399,10 +414,26 @@ function parseCodexOutput(raw) {
   }
   const lines = raw.split("\n").filter((line) => line.trim());
   const messages = [];
+  const activity = [];
   let resultContent = null;
+  let sessionId;
+  let usage = null;
   for (const line of lines) {
     try {
       const parsed = JSON.parse(line);
+      if (parsed.type === "thread.started" && typeof parsed.thread_id === "string") {
+        sessionId = parsed.thread_id;
+        continue;
+      }
+      if (parsed.type === "turn.completed" && parsed.usage) {
+        usage = {
+          input_tokens: parsed.usage.input_tokens ?? 0,
+          cached_input_tokens: parsed.usage.cached_input_tokens ?? 0,
+          output_tokens: parsed.usage.output_tokens ?? 0,
+          reasoning_output_tokens: parsed.usage.reasoning_output_tokens ?? 0
+        };
+        continue;
+      }
       if (parsed.type === "result" && typeof parsed.content === "string") {
         resultContent = parsed.content;
         continue;
@@ -411,7 +442,22 @@ function parseCodexOutput(raw) {
         messages.push(parsed.content);
         continue;
       }
-      if (parsed.item?.type === "agent_message" && typeof parsed.item.text === "string") {
+      if (parsed.item?.type === "command_execution") {
+        const cmd = parsed.item;
+        const shortCmd = cmd.command?.length > 80 ? cmd.command.slice(0, 77) + "..." : cmd.command;
+        const statusIcon = cmd.status === "declined" ? "\u2718" : cmd.exit_code === 0 ? "\u2714" : cmd.exit_code !== null ? "\u2718" : "\u25B6";
+        const statusLabel = cmd.status === "declined" ? "blocked" : cmd.status === "in_progress" ? "running" : cmd.exit_code === 0 ? "ok" : `exit ${cmd.exit_code}`;
+        if (cmd.status !== "in_progress") {
+          activity.push({
+            type: "exec",
+            command: shortCmd,
+            icon: statusIcon,
+            status: statusLabel
+          });
+        }
+        continue;
+      }
+      if (parsed.item?.type === "agent_message" && typeof parsed.item.text === "string" && parsed.type !== "item.started" && parsed.type !== "item.updated") {
         messages.push(parsed.item.text);
         continue;
       }
@@ -419,6 +465,45 @@ function parseCodexOutput(raw) {
         messages.push(parsed.text);
         continue;
       }
+      if (parsed.item?.type === "file_read") {
+        activity.push({
+          type: "read",
+          path: parsed.item.path || "file",
+          icon: "\u25B6",
+          status: "read"
+        });
+        continue;
+      }
+      if (parsed.item?.type === "file_write" || parsed.item?.type === "file_edit") {
+        activity.push({
+          type: "write",
+          path: parsed.item.path || "file",
+          icon: "\u270E",
+          status: "write"
+        });
+        continue;
+      }
+      if (parsed.item?.type === "file_change") {
+        const changes = Array.isArray(parsed.item.changes) ? parsed.item.changes : null;
+        if (changes && changes.length > 0) {
+          for (const change of changes) {
+            activity.push({
+              type: "write",
+              path: change?.path || "file",
+              icon: "\u270E",
+              status: change?.kind || "write"
+            });
+          }
+        } else {
+          activity.push({
+            type: "write",
+            path: parsed.item.path || "file",
+            icon: "\u270E",
+            status: "write"
+          });
+        }
+        continue;
+      }
     } catch {
     }
   }
@@ -438,7 +523,160 @@ function parseCodexOutput(raw) {
   }
   return {
     content: truncateResponse(agentMessage),
-    raw
+    activity,
+    usage,
+    raw,
+    sessionId
+  };
+}
+
+// src/util/text.ts
+function oneLine(text, max) {
+  const collapsed = text.replace(/\s+/g, " ").trim();
+  return collapsed.length > max ? collapsed.slice(0, max - 1) + "\u2026" : collapsed;
+}
+function baseName(p) {
+  if (!p) return "file";
+  const parts = p.split(/[\\/]/).filter(Boolean);
+  return parts.length > 0 ? parts[parts.length - 1] : p;
+}
+
+// src/runner/progress.ts
+function formatProgressMessage(evt) {
+  if (!evt || typeof evt !== "object") return null;
+  const item = evt.item;
+  if (item?.type === "command_execution") {
+    const cmd = oneLine(String(item.command ?? ""), 60);
+    if (item.status === "in_progress") return `running: ${cmd}`;
+    if (item.status === "declined") return `blocked: ${cmd}`;
+    if (item.exit_code === 0) return `ran: ${cmd}`;
+    return `failed (exit ${String(item.exit_code)}): ${cmd}`;
+  }
+  if (item?.type === "file_read") return `reading ${baseName(String(item.path ?? "file"))}`;
+  if (item?.type === "file_write" || item?.type === "file_edit") {
+    return `editing ${baseName(String(item.path ?? "file"))}`;
+  }
+  if (item?.type === "file_change") {
+    const changes = Array.isArray(item.changes) ? item.changes : null;
+    if (changes && changes.length > 0) {
+      return changes.length === 1 ? `editing ${baseName(String(changes[0]?.path ?? "file"))}` : `editing ${changes.length} files`;
+    }
+    return `editing ${baseName(String(item.path ?? "file"))}`;
+  }
+  if (item?.type === "reasoning" || evt.type === "turn.started") return "thinking\u2026";
+  if (item?.type === "agent_message" && typeof item.text === "string" && evt.type !== "item.started" && evt.type !== "item.updated") {
+    return "writing response\u2026";
+  }
+  return null;
+}
+
+// src/util/live-logger.ts
+import fs2 from "fs";
+import os3 from "os";
+import path3 from "path";
+import { createHash } from "crypto";
+function resolveLogPath(cwd) {
+  const override = process.env[LOG_ENV];
+  if (override && override.trim()) return path3.resolve(override.trim());
+  const base = path3.basename(cwd).replace(/[^a-zA-Z0-9._-]/g, "_") || "run";
+  const hash = createHash("sha1").update(cwd).digest("hex").slice(0, 8);
+  return path3.join(os3.tmpdir(), "skill-codex", `${base}-${hash}.log`);
+}
+function formatLogLines(evt) {
+  if (!evt || typeof evt !== "object") return [];
+  const item = evt.item;
+  if (item?.type === "command_execution") {
+    if (item.status === "in_progress") return [`  $ ${oneLine(String(item.command ?? ""), 120)}`];
+    if (item.status === "declined") return ["    \u2718 blocked"];
+    if (item.exit_code === 0) return ["    \u2714 ok"];
+    return [`    \u2718 exit ${String(item.exit_code)}`];
+  }
+  if (item?.type === "file_read") return [`  read   ${String(item.path ?? "file")}`];
+  if (item?.type === "file_write" || item?.type === "file_edit") {
+    return [`  write  ${String(item.path ?? "file")}`];
+  }
+  if (item?.type === "file_change") {
+    const changes = Array.isArray(item.changes) ? item.changes : null;
+    if (changes && changes.length > 0) {
+      return changes.map(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (change) => `  write  ${String(change?.path ?? "file")} (${String(change?.kind ?? "write")})`
+      );
+    }
+    return [`  write  ${String(item.path ?? "file")}`];
+  }
+  if (item?.type === "agent_message" && typeof item.text === "string" && evt.type !== "item.started" && evt.type !== "item.updated") {
+    return [`  msg    ${oneLine(item.text, 400)}`];
+  }
+  if (evt.type === "message" && typeof evt.content === "string") {
+    return [`  msg    ${oneLine(evt.content, 400)}`];
+  }
+  if (evt.type === "turn.completed" && evt.usage) {
+    const u = evt.usage;
+    const reasoning = u.reasoning_output_tokens ?? 0;
+    return [
+      `  tokens: ${u.input_tokens ?? 0} in \u2192 ${u.output_tokens ?? 0} out${reasoning > 0 ? ` (+${reasoning} reasoning)` : ""}`
+    ];
+  }
+  return [];
+}
+function createLiveLogger(opts) {
+  const logPath = resolveLogPath(opts.cwd);
+  let stream = null;
+  try {
+    fs2.mkdirSync(path3.dirname(logPath), { recursive: true });
+    stream = fs2.createWriteStream(logPath, { flags: "a" });
+  } catch {
+    stream = null;
+  }
+  const line = (text) => {
+    try {
+      stream?.write(text + "\n");
+    } catch {
+    }
+  };
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  line("");
+  line("=".repeat(60));
+  line(`> codex ${opts.mode}  ${startedAt}`);
+  line(`  cwd:  ${opts.cwd}`);
+  line(`  task: ${oneLine(opts.prompt, 200)}`);
+  line("-".repeat(60));
+  const handleEvent = (raw) => {
+    const trimmed = raw.trim();
+    if (!trimmed) return;
+    let evt;
+    try {
+      evt = JSON.parse(trimmed);
+    } catch {
+      return;
+    }
+    for (const l of formatLogLines(evt)) line(l);
+  };
+  let buffer = "";
+  return {
+    path: logPath,
+    write(fragment) {
+      buffer += fragment;
+      let idx;
+      while ((idx = buffer.indexOf("\n")) >= 0) {
+        const lineStr = buffer.slice(0, idx);
+        buffer = buffer.slice(idx + 1);
+        handleEvent(lineStr);
+      }
+    },
+    finish(summary) {
+      if (buffer.trim()) {
+        handleEvent(buffer);
+        buffer = "";
+      }
+      line("-".repeat(60));
+      line(`# done  ${(/* @__PURE__ */ new Date()).toISOString()}  ${summary}`);
+      try {
+        stream?.end();
+      } catch {
+      }
+    }
   };
 }
 
@@ -479,14 +717,41 @@ async function execCodex(params) {
   }
   return new Promise((resolve, reject) => {
     const timeoutMs = getTimeout(params.timeoutMs);
-    const args = ["exec", "--json", "--skip-git-repo-check"];
-    if (params.mode === "full-auto") {
-      args.push("--full-auto");
+    let args;
+    let sendStdinPrompt;
+    if (params.review) {
+      args = ["exec", "review", "--json", "--skip-git-repo-check"];
+      if (params.reviewBase) {
+        args.push("--base", params.reviewBase);
+        sendStdinPrompt = false;
+      } else if (params.reviewCommit) {
+        args.push("--commit", params.reviewCommit);
+        sendStdinPrompt = false;
+      } else if (params.prompt?.trim()) {
+        sendStdinPrompt = true;
+      } else {
+        args.push("--uncommitted");
+        sendStdinPrompt = false;
+      }
+    } else if (params.sessionId) {
+      args = ["exec", "resume", params.sessionId, "--json", "--skip-git-repo-check"];
+      sendStdinPrompt = true;
     } else {
-      args.push("--sandbox", "read-only");
+      const sandbox = params.sandbox ?? (params.mode === "full-auto" ? "workspace-write" : "read-only");
+      args = ["exec", "--json", "--skip-git-repo-check", "--sandbox", sandbox];
+      sendStdinPrompt = true;
+    }
+    if (params.model) {
+      args.push("-m", params.model);
+    }
+    if (params.reasoningEffort) {
+      args.push("-c", `model_reasoning_effort=${params.reasoningEffort}`);
+    }
+    args.push(...getSandboxConfigArgs());
+    const stdinPrompt = params.prompt ?? "";
+    if (sendStdinPrompt) {
+      args.push("-");
     }
-    const stdinPrompt = params.prompt;
-    args.push("-");
     const env = {
       ...process.env,
       [BRIDGE_DEPTH_ENV]: String(getNextDepth())
@@ -495,27 +760,86 @@ async function execCodex(params) {
       cwd: params.cwd,
       env,
       stdio: ["pipe", "pipe", "pipe"],
-      shell: false,
+      shell: process.platform === "win32",
       windowsHide: true
     });
     const { clear: clearTimeout_, promise: timeoutPromise } = setupTimeout(child, timeoutMs);
+    const startedAt = Date.now();
+    const logger = createLiveLogger({
+      cwd: params.cwd,
+      mode: params.mode,
+      prompt: params.prompt
+    });
+    process.stderr.write(`[skill-codex] live log: ${logger.path}
+`);
+    let heartbeat = null;
+    if (params.onProgress) {
+      heartbeat = setInterval(() => {
+        const secs = Math.round((Date.now() - startedAt) / 1e3);
+        params.onProgress?.(`Codex working\u2026 ${secs}s elapsed`);
+      }, HEARTBEAT_INTERVAL_MS);
+      if (typeof heartbeat.unref === "function") heartbeat.unref();
+    }
+    const stopHeartbeat = () => {
+      if (heartbeat) {
+        clearInterval(heartbeat);
+        heartbeat = null;
+      }
+    };
+    const decoder = new StringDecoder("utf8");
+    let progressBuf = "";
+    const consumeForProgress = (text) => {
+      if (!params.onProgress) return;
+      progressBuf += text;
+      let idx;
+      while ((idx = progressBuf.indexOf("\n")) >= 0) {
+        const lineStr = progressBuf.slice(0, idx).trim();
+        progressBuf = progressBuf.slice(idx + 1);
+        if (!lineStr) continue;
+        try {
+          const msg = formatProgressMessage(JSON.parse(lineStr));
+          if (msg) params.onProgress(msg);
+        } catch {
+        }
+      }
+    };
+    let logFinished = false;
+    const finishLog = (summary) => {
+      stopHeartbeat();
+      if (logFinished) return;
+      logFinished = true;
+      try {
+        logger.write(decoder.end());
+        logger.finish(summary);
+      } catch {
+      }
+    };
     const stdoutChunks = [];
     let stderr = "";
     child.stdout?.on("data", (chunk) => {
       stdoutChunks.push(chunk);
+      const text = decoder.write(chunk);
+      try {
+        logger.write(text);
+      } catch {
+      }
+      consumeForProgress(text);
     });
     child.stderr?.on("data", (chunk) => {
       stderr += chunk.toString();
     });
-    child.stdin?.write(stdinPrompt);
+    if (sendStdinPrompt) {
+      child.stdin?.write(stdinPrompt);
+    }
     child.stdin?.end();
     const onClose = (exitCode) => {
       clearTimeout_();
+      finishLog(exitCode === 0 || exitCode === null ? "ok" : `exit ${exitCode}`);
       const stdout = Buffer.concat(stdoutChunks).toString();
       if (exitCode === 0 || exitCode === null) {
         try {
           const result = parseCodexOutput(stdout);
-          resolve(result);
+          resolve({ ...result, logPath: logger.path, durationMs: Date.now() - startedAt });
         } catch (err) {
           reject(err);
         }
@@ -526,6 +850,7 @@ async function execCodex(params) {
     child.on("close", onClose);
     child.on("error", (err) => {
       clearTimeout_();
+      finishLog("spawn error");
       if (err.code === "ENOENT") {
         reject(new CliNotFoundError());
       } else {
@@ -533,6 +858,7 @@ async function execCodex(params) {
       }
     });
     timeoutPromise.catch((err) => {
+      finishLog("timeout");
       reject(err);
     });
   });
@@ -587,12 +913,81 @@ async function withRetry(fn, options = {}) {
 var TOOL_NAME = "codex_exec";
 var TOOL_DESCRIPTION = "Execute a task using OpenAI Codex CLI. Use for code review, implementation tasks, or getting a second opinion. Codex output is a SUGGESTION \u2014 evaluate it critically before applying.";
 var inputSchema = z.object({
-  prompt: z.string().describe("The task description for Codex"),
+  prompt: z.string().optional().describe("The task description for Codex"),
   mode: z.enum(["exec", "full-auto"]).default("exec").describe("exec = read-only with confirmation, full-auto = can write files"),
+  sandbox: z.enum(["read-only", "workspace-write", "danger-full-access"]).optional().describe(
+    "Explicit Codex sandbox policy; overrides mode. read-only = no writes, workspace-write = write within cwd, danger-full-access = unrestricted (use with care)."
+  ),
+  sessionId: z.string().regex(/^[A-Za-z0-9_-]{1,128}$/, "sessionId must be a Codex thread id (letters, digits, '-', '_')").optional().describe(
+    "Resume a prior Codex session by its thread id (returned in a previous response) so Codex retains context across calls."
+  ),
+  model: z.string().regex(/^[A-Za-z0-9._-]{1,64}$/).optional().describe(
+    "Codex model to use (e.g. gpt-5.5, gpt-5.4, gpt-5.4-mini). Omit to use Codex's configured default."
+  ),
+  reasoningEffort: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional().describe("How much reasoning effort Codex spends. Omit for the model's default."),
+  review: z.boolean().optional().describe(
+    "Run Codex's native diff-scoped review (`codex exec review`) instead of a freeform prompt. The prompt becomes optional custom review instructions."
+  ),
+  reviewBase: z.string().regex(/^[A-Za-z0-9._\/-]{1,128}$/).optional().describe("With review: diff against this base branch (default: uncommitted changes)."),
+  reviewCommit: z.string().regex(/^[0-9a-fA-F]{4,64}$/).optional().describe("With review: review the changes introduced by this commit SHA."),
   cwd: z.string().optional().describe("Working directory (defaults to server cwd)"),
   timeoutMs: z.number().optional().describe("Override default timeout in milliseconds"),
   requireGit: z.boolean().default(false).describe("Fail if not inside a git repository")
 });
+var TOOL_INPUT_JSON_SCHEMA = {
+  type: "object",
+  properties: {
+    prompt: { type: "string", description: "The task description for Codex" },
+    mode: {
+      type: "string",
+      enum: ["exec", "full-auto"],
+      default: "exec",
+      description: "exec = read-only, full-auto = can write files"
+    },
+    sandbox: {
+      type: "string",
+      enum: ["read-only", "workspace-write", "danger-full-access"],
+      description: "Explicit Codex sandbox policy; overrides mode. read-only = no writes, workspace-write = write within cwd, danger-full-access = unrestricted (use with care)."
+    },
+    sessionId: {
+      type: "string",
+      pattern: "^[A-Za-z0-9_-]{1,128}$",
+      description: "Resume a prior Codex session by its thread id (returned in a previous response) so Codex retains context across calls."
+    },
+    model: {
+      type: "string",
+      pattern: "^[A-Za-z0-9._-]{1,64}$",
+      description: "Codex model to use (e.g. gpt-5.5, gpt-5.4, gpt-5.4-mini). Omit to use Codex's configured default."
+    },
+    reasoningEffort: {
+      type: "string",
+      enum: ["minimal", "low", "medium", "high", "xhigh"],
+      description: "How much reasoning effort Codex spends. Omit for the model's default."
+    },
+    review: {
+      type: "boolean",
+      description: "Run Codex's native diff-scoped review (`codex exec review`) instead of a freeform prompt. The prompt becomes optional custom review instructions."
+    },
+    reviewBase: {
+      type: "string",
+      pattern: "^[A-Za-z0-9._\\/-]{1,128}$",
+      description: "With review: diff against this base branch (default: uncommitted changes)."
+    },
+    reviewCommit: {
+      type: "string",
+      pattern: "^[0-9a-fA-F]{4,64}$",
+      description: "With review: review the changes introduced by this commit SHA."
+    },
+    cwd: { type: "string", description: "Working directory (defaults to server cwd)" },
+    timeoutMs: { type: "number", description: "Override default timeout in milliseconds" },
+    requireGit: {
+      type: "boolean",
+      default: false,
+      description: "Fail if not inside a git repository"
+    }
+  },
+  required: []
+};
 function formatError(err) {
   if (err instanceof BridgeError) {
     return `[skill-codex error: ${err.code}] ${err.message}`;
@@ -602,15 +997,83 @@ function formatError(err) {
   }
   return `[skill-codex error] Unknown error: ${String(err)}`;
 }
-async function handleCodexExec(input, serverCwd) {
+function formatRichResponse(result, input, cwd) {
+  const lines = [];
+  const sandboxLabel = input.sandbox ?? (input.mode === "full-auto" ? "workspace-write" : "read-only");
+  const label = input.review ? "review" : input.sessionId ? "resumed" : sandboxLabel;
+  const metaParts = [label];
+  if (input.model) {
+    metaParts.push(input.model);
+  }
+  if (input.reasoningEffort) {
+    metaParts.push(`effort:${input.reasoningEffort}`);
+  }
+  metaParts.push(cwd);
+  if (typeof result.durationMs === "number") {
+    metaParts.push(`${(result.durationMs / 1e3).toFixed(1)}s`);
+  }
+  if (result.usage) {
+    const {
+      input_tokens: inp,
+      output_tokens: out,
+      cached_input_tokens: cached,
+      reasoning_output_tokens: reasoning
+    } = result.usage;
+    metaParts.push(
+      `${inp} tok in${cached > 0 ? ` (${cached} cached)` : ""} \u2192 ${out} out${reasoning > 0 ? ` (+${reasoning} reasoning)` : ""}`
+    );
+  }
+  lines.push(`[${metaParts.join(" \u2502 ")}]`);
+  if (result.sessionId) {
+    lines.push(`  session: ${result.sessionId} (pass as sessionId to continue this conversation)`);
+  }
+  if (result.logPath) {
+    lines.push(`  live log: ${result.logPath}`);
+  }
+  if (result.activity.length > 0) {
+    for (const a of result.activity) {
+      if (a.type === "exec") {
+        lines.push(`  ${a.icon} exec: ${a.command}  (${a.status})`);
+      } else if (a.type === "read") {
+        lines.push(`  \u25B6 read: ${a.path}`);
+      } else if (a.type === "write") {
+        lines.push(`  \u270E write: ${a.path}`);
+      }
+    }
+  }
+  lines.push("");
+  lines.push(result.content);
+  return lines.join("\n");
+}
+async function handleCodexExec(input, serverCwd, onProgress) {
   const rawCwd = input.cwd ?? serverCwd;
-  const cwd = path3.resolve(rawCwd);
-  if (!fs2.existsSync(cwd) || !fs2.statSync(cwd).isDirectory()) {
+  const cwd = path4.resolve(rawCwd);
+  if (!fs3.existsSync(cwd) || !fs3.statSync(cwd).isDirectory()) {
     return {
       content: [{ type: "text", text: `[skill-codex error: INVALID_CWD] cwd is not an existing directory: ${cwd}` }],
       isError: true
     };
   }
+  const optError = (msg) => ({
+    content: [{ type: "text", text: `[skill-codex error: INVALID_OPTIONS] ${msg}` }],
+    isError: true
+  });
+  if (input.review && input.sessionId) return optError("review and sessionId are mutually exclusive");
+  if (input.reviewBase && input.reviewCommit) return optError("reviewBase and reviewCommit are mutually exclusive");
+  if ((input.reviewBase ?? input.reviewCommit) && !input.review) {
+    return optError("reviewBase/reviewCommit require review: true");
+  }
+  if (input.review && (input.reviewBase ?? input.reviewCommit) && input.prompt?.trim()) {
+    return optError(
+      "a review target (reviewBase/reviewCommit) can't be combined with a prompt \u2014 Codex review takes a target OR instructions, not both"
+    );
+  }
+  if (!input.review && !input.prompt?.trim()) {
+    return {
+      content: [{ type: "text", text: "[skill-codex error: MISSING_PROMPT] prompt is required unless review is set" }],
+      isError: true
+    };
+  }
   let lockRelease = null;
   try {
     const { lockHandle } = await runPreflight({
@@ -620,14 +1083,23 @@ async function handleCodexExec(input, serverCwd) {
     lockRelease = lockHandle?.release ?? null;
     const result = await withRetry(
       () => execCodex({
-        prompt: input.prompt,
+        prompt: input.prompt ?? "",
         cwd,
         mode: input.mode,
-        timeoutMs: input.timeoutMs
+        sandbox: input.sandbox,
+        sessionId: input.sessionId,
+        model: input.model,
+        reasoningEffort: input.reasoningEffort,
+        review: input.review,
+        reviewBase: input.reviewBase,
+        reviewCommit: input.reviewCommit,
+        timeoutMs: input.timeoutMs,
+        onProgress
       })
     );
+    const formatted = formatRichResponse(result, input, cwd);
     return {
-      content: [{ type: "text", text: result.content }]
+      content: [{ type: "text", text: formatted }]
     };
   } catch (err) {
     return {
@@ -642,7 +1114,7 @@ async function handleCodexExec(input, serverCwd) {
 // src/server.ts
 function createServer(cwd) {
   const server = new Server(
-    { name: "skill-codex", version: "0.2.0" },
+    { name: "skill-codex", version: "0.7.1" },
     { capabilities: { tools: {} } }
   );
   server.setRequestHandler(ListToolsRequestSchema, async () => ({
@@ -650,30 +1122,11 @@ function createServer(cwd) {
       {
         name: TOOL_NAME,
         description: TOOL_DESCRIPTION,
-        inputSchema: {
-          type: "object",
-          properties: {
-            prompt: { type: "string", description: "The task description for Codex" },
-            mode: {
-              type: "string",
-              enum: ["exec", "full-auto"],
-              default: "exec",
-              description: "exec = read-only, full-auto = can write files"
-            },
-            cwd: { type: "string", description: "Working directory (defaults to server cwd)" },
-            timeoutMs: { type: "number", description: "Override default timeout in milliseconds" },
-            requireGit: {
-              type: "boolean",
-              default: false,
-              description: "Fail if not inside a git repository"
-            }
-          },
-          required: ["prompt"]
-        }
+        inputSchema: TOOL_INPUT_JSON_SCHEMA
       }
     ]
   }));
-  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+  server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
     if (request.params.name !== TOOL_NAME) {
       return {
         content: [{ type: "text", text: `Unknown tool: ${request.params.name}` }],
@@ -692,7 +1145,17 @@ function createServer(cwd) {
         isError: true
       };
     }
-    return handleCodexExec(parsed.data, cwd);
+    const progressToken = request.params._meta?.progressToken;
+    let progressCounter = 0;
+    const onProgress = progressToken === void 0 ? void 0 : (message) => {
+      progressCounter += 1;
+      void extra.sendNotification({
+        method: "notifications/progress",
+        params: { progressToken, progress: progressCounter, message }
+      }).catch(() => {
+      });
+    };
+    return handleCodexExec(parsed.data, cwd, onProgress);
   });
   return server;
 }