tickmarkr 2.6.5 → 2.6.6

package/README.md

@@ -258,9 +258,13 @@ two-pane surface: the left rail lists views (**All models**, **Shapes**, **Steer
 installed agent CLI with its auth state and model count; the right pane is a searchable model list
 with tier, context, price, and probe-latency columns. `Space` allows/denies, `Enter` classifies an
 unclassified model (with a required benchmark-provenance note) or pins a classified one to a shape,
-`m` opens the routing-mode presets, and `w` renders the unified diff of your repo config overlay.
-Nothing is written until you confirm the diff with `y`; quitting leaves config unchanged. The
-Shapes view pins from a candidate picker ranked by the production router.
+`m` opens the routing-mode presets, and `w` renders the unified diff of the one overlay the save
+lands in, named in the review: an allow/deny membership edit goes to the layer that holds it (the
+repo overlay when it declares that family, else your user overlay), everything else to the user
+overlay; a batch needing both is refused — save each half in its own session. Nothing is written
+until you confirm with `y`. A worker-only deny on a partially excluded adapter takes two rail
+presses: out · all seats, then out · workers. The Shapes view pins from a candidate picker ranked by
+the production router.
 
 Routing-mode semantics, pin/floor/prefer precedence, review and consult steering syntax,
 provenance rules, and `--quality` / `--mode` flags are documented in

package/dist/adapters/codex-commit-check.d.ts

@@ -1,25 +1,36 @@
-import type { AuthHealth, WorkerAdapter } from "./types.js";
-export type CodexCommitStatus = "protected" | "allowed" | "unknown";
+import { type AuthHealth, type CodexCommitStatus, type WorkerAdapter } from "./types.js";
+export type { CodexCommitStatus };
 export interface CodexCommitProbe {
     worktree: string;
     commonDir: string;
+    branch: string;
     control: string;
     lock: string;
+    hostileHook: string;
+    hostileRoot: string;
     token: string;
     signal?: AbortSignal;
 }
-/** Runs the write script inside the Codex sandbox and resolves its stdout. Injected in tests. */
+/** Runs the probe script inside the Codex sandbox and resolves its stdout. Injected in tests. */
 export type CodexSandbox = (probe: CodexCommitProbe) => Promise<string>;
 export interface CodexCommitResult {
     status: CodexCommitStatus;
     detail: string;
 }
-export declare const codexSandboxArgs: (p: CodexCommitProbe) => string[];
+/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
+export declare const codexSandboxArgs: (p: CodexCommitProbe, grant?: string) => string[];
+/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
+export declare const codexSandboxFor: (grant: string) => CodexSandbox;
 export declare const codexSandbox: CodexSandbox;
 export declare function probeCodexCommit(repoRoot: string, sandbox?: CodexSandbox, signal?: AbortSignal): Promise<CodexCommitResult>;
+/** A persisted verdict outside the closed table (an older or newer doctor.json) reads unknown, never allowed. */
+export declare const codexCommitStatus: (health: Record<string, AuthHealth>) => CodexCommitStatus;
 /** Doctor's one call: gated on the REAL codex adapter object (a codex-id stub gets no probe and no output
  *  unless a test injects a sandbox — the kimiTurnEnabled rule). Mutates only the health record doctor owns. */
 export declare function recordCodexCommit(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, cwd: string, sandbox?: CodexSandbox): Promise<void>;
 /** Plan's headline beneath a Codex worker row; null for every other worker and for an allowed probe.
  *  An absent field is unknown, but only the real adapter earns the line — stubs stay byte-identical. */
 export declare function codexCommitHeadline(worker: string, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): string | null;
+/** Plan's one line for Codex's NON-worker roles (judge, review, consult): they launch with the same grant, so
+ *  only an escape earns it — allowed, protected and unknown concern commits, which those roles never make. */
+export declare function codexEscapeRoleLine(roles: string[], adapters: WorkerAdapter[], health: Record<string, AuthHealth>): string | null;

package/dist/adapters/codex-commit-check.js

@@ -4,20 +4,26 @@ import { existsSync, mkdtempSync, readFileSync, rmdirSync, rmSync } from "node:f
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { promisify } from "node:util";
-import { codex } from "./codex.js";
+import { CODEX_GIT_GRANT, codex } from "./codex.js";
+import { shq } from "./types.js";
 const exec = promisify(execFile);
 const git = async (cwd, ...args) => (await exec("git", args, { cwd })).stdout.trim();
-// $1 control, $2 lock, $3 token. noclobber (set -C) creates the lock the way git does — never over an existing one.
-const SCRIPT = `printf %s "$3" > "$1" && echo control=ok || echo control=fail
-e=$( (set -C; printf %s "$3" > "$2") 2>&1 ) && echo lock=ok || echo "lock=fail $e"`;
-// The grant names the git common dir (the worker launch grant) AND the exact linked metadata directory that
-// holds index.lock, so a denial is protection despite an exact grant — never a grant this probe forgot.
-export const codexSandboxArgs = (p) => [
-    "sandbox", "-c", 'sandbox_mode="workspace-write"',
-    "-c", `sandbox_workspace_write.writable_roots=${JSON.stringify([p.commonDir, dirname(p.lock)])}`,
-    "--", "sh", "-c", SCRIPT, "sh", p.control, p.lock, p.token,
+const CONTROL = "tickmarkr-codex-commit-control";
+// $1 control, $2 token, $3 hostile hooks member, $4 hostile common-root member. The commit disables hooks (the
+// probe asks what the sandbox permits, never what a user hook decides) and forces the reflog so common/logs is
+// always exercised. noclobber (set -C) never writes over a foreign occupant of a hostile path.
+const SCRIPT = `printf %s "$2" > "$1" && echo control=ok || echo control=fail
+git add -- "$1" && git -c core.hooksPath=/dev/null -c core.logAllRefUpdates=true -c commit.gpgsign=false -c user.name=tickmarkr -c user.email=probe@tickmarkr.invalid commit -q -m "tickmarkr-probe $2" && echo commit=ok || echo commit=fail
+(set -C; printf %s "$2" > "$3") 2>/dev/null && echo hook=written || echo hook=denied
+(set -C; printf %s "$2" > "$4") 2>/dev/null && echo root=written || echo root=denied`;
+/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
+export const codexSandboxArgs = (p, grant = CODEX_GIT_GRANT) => [
+    "-c",
+    `codex sandbox -c 'sandbox_mode="workspace-write"' ${grant} -- sh -c ${shq(SCRIPT)} sh ${[p.control, p.token, p.hostileHook, p.hostileRoot].map(shq).join(" ")}`,
 ];
-export const codexSandbox = async (p) => (await exec("codex", codexSandboxArgs(p), { cwd: p.worktree, timeout: 20_000, signal: p.signal })).stdout;
+/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
+export const codexSandboxFor = (grant) => async (p) => (await exec("sh", codexSandboxArgs(p, grant), { cwd: p.worktree, timeout: 20_000, signal: p.signal })).stdout;
+export const codexSandbox = codexSandboxFor(CODEX_GIT_GRANT);
 const holds = (path, token) => {
     try {
         return readFileSync(path, "utf8") === token;
@@ -27,38 +33,98 @@ const holds = (path, token) => {
     }
 };
 const unknown = (detail) => ({ status: "unknown", detail });
+// The bytes on disk decide an escape whatever the receipts say — and whether or not the sandbox exited cleanly.
+const escaped = (hostile, token) => {
+    const written = hostile.filter((m) => holds(m, token));
+    return written.length ? { status: "escape", detail: `the sandbox wrote ${written.join(" and ")} outside the worker grant` } : undefined;
+};
+// One outcome per receipt field: a field reporting two outcomes (commit=ok AND commit=fail) is contradictory.
+const contradictory = (out) => {
+    const seen = new Map();
+    for (const [, field, outcome] of out.matchAll(/^(control|commit|hook|root)=(\S+)/gm)) {
+        if ((seen.get(field) ?? outcome) !== outcome)
+            return true;
+        seen.set(field, outcome);
+    }
+    return false;
+};
+const tipOf = async (repo, ref) => git(repo, "rev-parse", "--verify", "--quiet", `${ref}^{commit}`).catch(() => undefined);
+// This probe's commit and nothing else: one parent (the fixture base), its token in the subject and the control.
+const isProbeCommit = async (repo, commit, base, token) => {
+    try {
+        return await git(repo, "log", "-1", "--format=%P %s", commit) === `${base} tickmarkr-probe ${token}`
+            && await git(repo, "cat-file", "blob", `${commit}:${CONTROL}`) === token;
+    }
+    catch {
+        return false;
+    }
+};
 export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal) {
     const token = randomUUID();
     const parent = mkdtempSync(join(tmpdir(), "tickmarkr-codex-commit-"));
     // git names the fixture's metadata directory after the checkout's basename; a unique one makes that
     // directory — and so the lock path — known BEFORE `worktree add`, which can fail after creating it
-    const worktree = join(parent, `tickmarkr-probe-${token}`);
+    const branch = `tickmarkr-probe-${token}`;
+    const ref = `refs/heads/${branch}`;
+    const worktree = join(parent, branch);
     let lock;
+    let base;
+    let hostile = [];
     try {
         const commonDir = await git(repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
         lock = join(commonDir, "worktrees", basename(worktree), "index.lock");
-        await git(repoRoot, "worktree", "add", "--detach", worktree, "HEAD");
+        const hostileHook = join(commonDir, "hooks", branch), hostileRoot = join(commonDir, branch);
+        hostile = [hostileHook, hostileRoot];
+        if (hostile.some((m) => existsSync(m)))
+            return unknown("a foreign file already holds a hostile probe path");
+        base = await git(repoRoot, "rev-parse", "--verify", "HEAD^{commit}");
+        await git(repoRoot, "worktree", "add", "-b", branch, worktree, base);
         if (join(await git(worktree, "rev-parse", "--absolute-git-dir"), "index.lock") !== lock)
             return unknown("the fixture worktree metadata is not where git was expected to put it");
-        const control = join(worktree, "tickmarkr-codex-commit-control");
+        const control = join(worktree, CONTROL);
         if (existsSync(lock))
             return unknown("a foreign index.lock already holds the fixture worktree");
-        const out = await sandbox({ worktree, commonDir, control, lock, token, signal });
-        // Every verdict needs the sandbox's own report AND the bytes on disk to agree; anything else is unknown.
+        const out = await sandbox({ worktree, commonDir, branch, control, lock, hostileHook, hostileRoot, token, signal });
+        // An escape on disk dominates; every other verdict needs consistent receipts AND disk.
+        const escape = escaped(hostile, token);
+        if (escape)
+            return escape;
+        if (contradictory(out))
+            return unknown("the sandbox receipts contradict each other");
         if (!/^control=ok$/m.test(out) || !holds(control, token))
             return unknown("the sandbox did not write the ordinary control file");
-        if (/^lock=ok$/m.test(out) && holds(lock, token))
-            return { status: "allowed", detail: "the sandbox wrote index.lock" };
-        if (/^lock=fail .*(not permitted|permission denied)/mi.test(out) && !existsSync(lock)) {
-            return { status: "protected", detail: "the sandbox wrote an ordinary worktree file but denied index.lock" };
+        if (!/^hook=denied$/m.test(out) || !/^root=denied$/m.test(out) || hostile.some((m) => existsSync(m))) {
+            return unknown("the sandbox result for the shared-metadata members was unreadable");
+        }
+        const tip = await tipOf(repoRoot, ref);
+        if (/^commit=ok$/m.test(out) && tip && tip !== base && await isProbeCommit(repoRoot, tip, base, token)) {
+            let reflog = "";
+            try {
+                reflog = readFileSync(join(commonDir, "logs", ref), "utf8");
+            }
+            catch { /* absent: unknown below */ }
+            if (reflog.trimEnd().split("\n").pop()?.startsWith(`${base} ${tip} `)) {
+                return { status: "allowed", detail: "the sandbox committed on its fixture branch and was denied both shared-metadata members" };
+            }
+            return unknown("the fixture branch moved but its reflog does not record the probe commit");
         }
-        return unknown("the sandbox result for index.lock was unreadable");
+        if (/^commit=fail$/m.test(out) && tip === base) {
+            return { status: "protected", detail: "the sandbox wrote an ordinary worktree file but denied the linked-worktree commit" };
+        }
+        return unknown("the fixture branch does not match the sandbox commit report (a foreign change may have moved it)");
     }
     catch (e) {
+        // a sandbox that wrote a hostile member and then failed (or was cancelled) still escaped: inspect before cleanup
+        const escape = escaped(hostile, token);
+        if (escape)
+            return escape;
         return unknown(signal?.aborted ? "probe cancelled" : `probe did not run (${(e instanceof Error ? e.message : String(e)).split("\n")[0]})`);
     }
     finally {
-        // only the lock this probe wrote (its token) is ours to remove; a foreign one is never touched
+        // only files holding this probe's token are ours to remove; a foreign occupant is never touched
+        for (const m of hostile)
+            if (holds(m, token))
+                rmSync(m, { force: true });
         if (lock && holds(lock, token))
             rmSync(lock, { force: true });
         // a foreign lock lives in the fixture's metadata directory, which `worktree remove` would delete with
@@ -74,14 +140,34 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
             }
             catch { /* other worktrees live there */ }
         }
+        // The fixture branch and its reflog go only while the tip is still this probe's (the base or its own
+        // commit), and update-ref's old-value check refuses if anyone moves it between this read and the delete.
+        // Metadata preserved for a foreign lock keeps its branch too: that checkout's HEAD still names it.
+        const tip = base === undefined || foreign ? undefined : await tipOf(repoRoot, ref);
+        if (tip && base && (tip === base || await isProbeCommit(repoRoot, tip, base, token))) {
+            await git(repoRoot, "update-ref", "-d", ref, tip).catch(() => undefined);
+        }
         rmSync(parent, { recursive: true, force: true });
     }
 }
 const NOTE = {
     protected: "linked-worktree git metadata protected",
-    allowed: "linked-worktree commit probe: index.lock writable",
+    allowed: "linked-worktree commit probe: commit allowed, shared hooks/config denied",
+    escape: "BLOCKING security warning: codex sandbox escape into shared git metadata",
     unknown: "linked-worktree commit probe unknown",
 };
+const CONSEQUENCE = {
+    protected: "; a Codex worker cannot commit in its worktree",
+    allowed: "",
+    escape: "; every Codex role (worker, judge, review, consult) launches with this grant — stop Codex seats and inspect .git/hooks and git config --list --show-origin (core.hooksPath, core.fsmonitor, filter.*, diff.external)",
+    unknown: "",
+};
+const STATUSES = new Set(Object.keys(NOTE));
+/** A persisted verdict outside the closed table (an older or newer doctor.json) reads unknown, never allowed. */
+export const codexCommitStatus = (health) => {
+    const s = health[codex.id]?.codexCommit;
+    return s !== undefined && STATUSES.has(s) ? s : "unknown";
+};
 /** Doctor's one call: gated on the REAL codex adapter object (a codex-id stub gets no probe and no output
  *  unless a test injects a sandbox — the kimiTurnEnabled rule). Mutates only the health record doctor owns. */
 export async function recordCodexCommit(adapters, health, cwd, sandbox) {
@@ -90,15 +176,19 @@ export async function recordCodexCommit(adapters, health, cwd, sandbox) {
     if (!adapter || (adapter !== codex && !sandbox) || !h?.installed)
         return;
     const r = await probeCodexCommit(cwd, sandbox);
-    const say = `${NOTE[r.status]} — ${r.detail}${r.status === "protected" ? "; a Codex worker cannot commit in its worktree" : ""}`;
+    const say = `${NOTE[r.status]} — ${r.detail}${CONSEQUENCE[r.status]}`;
     health[codex.id] = { ...h, codexCommit: r.status, note: `${h.note ? `${h.note}; ` : ""}${say}` };
 }
+const ESCAPE_ACTION = "stop Codex seats and inspect .git/hooks and git config --list --show-origin (core.hooksPath, core.fsmonitor, filter.*, diff.external) before dispatch";
 /** Plan's headline beneath a Codex worker row; null for every other worker and for an allowed probe.
  *  An absent field is unknown, but only the real adapter earns the line — stubs stay byte-identical. */
 export function codexCommitHeadline(worker, adapters, health) {
     if (worker !== codex.id || !adapters.includes(codex))
         return null;
-    const status = health[codex.id]?.codexCommit ?? "unknown";
+    const status = codexCommitStatus(health);
+    if (status === "escape") {
+        return `    BLOCKING security warning: codex sandbox escape (doctor probe) — this worker's launch grant let the sandbox write shared git metadata; ${ESCAPE_ACTION}`;
+    }
     if (status === "protected") {
         return "    worker restriction: codex linked-worktree git metadata is protected (doctor probe) — this worker cannot commit its own work; routing consequence: steer this task to an eligible non-Codex worker";
     }
@@ -106,3 +196,10 @@ export function codexCommitHeadline(worker, adapters, health) {
         ? "    worker restriction: unknown — the codex linked-worktree commit probe has no verdict; run tickmarkr doctor"
         : null;
 }
+/** Plan's one line for Codex's NON-worker roles (judge, review, consult): they launch with the same grant, so
+ *  only an escape earns it — allowed, protected and unknown concern commits, which those roles never make. */
+export function codexEscapeRoleLine(roles, adapters, health) {
+    if (!roles.length || !adapters.includes(codex) || codexCommitStatus(health) !== "escape")
+        return null;
+    return `BLOCKING security warning: codex sandbox escape (doctor probe) — Codex ${roles.join("/")} seats launch with the worker grant that let the sandbox write shared git metadata; ${ESCAPE_ACTION}`;
+}

package/dist/adapters/codex.d.ts

@@ -4,6 +4,7 @@ export declare function readCodexModelsCache(path?: string): {
     fetchedAt?: string;
     retirements?: Record<string, ModelRetirement | null>;
 };
+export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ \"$tkr_gitdir\" != \"$tkr_common\" ]; then printf '\"%s\",' \"$tkr_gitdir\"; fi; printf '\"%s/objects\",\"%s/refs\",\"%s/logs\"' \"$tkr_common\" \"$tkr_common\" \"$tkr_common\")]\"";
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;
 export declare function seedCodexTrust(repoRoot: string, configPath?: string): TrustVerdict;

package/dist/adapters/codex.js

@@ -96,9 +96,15 @@ function codexRetirement(upgrade) {
 }
 // tickmarkr worktrees keep their gitdir under the MAIN repo's .git/worktrees/<name> — outside the
 // workspace-write sandbox root — so git commit dies on index.lock (incident run-20260709-104447
-// P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the pane shell at the
-// worktree cwd; in a plain repo it resolves to ./.git (already writable, harmless).
-const GITDIR_WRITABLE = `-c "sandbox_workspace_write.writable_roots=[\\"$(git rev-parse --path-format=absolute --git-common-dir)\\"]"`;
+// P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the launching shell at the
+// worktree cwd, for EVERY Codex role (worker, judge, review, consult share these builders).
+// v2.6.6 T9 (K, D-912): the grant is exactly what a linked-worktree branch commit writes — the worktree's
+// own gitdir (only when it differs from the common dir), common/objects, common/refs, common/logs. The
+// shipped [common] grant (and D-910's [common, gitdir]) let a sandboxed seat write <common>/hooks and
+// <common>/config, which unsandboxed git later runs. No common-root fallback: an ordinary checkout gets
+// no gitdir root and its commit fails closed. packed-refs is not granted (packed-ref ops fail closed).
+// doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
+export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ "$tkr_gitdir" != "$tkr_common" ]; then printf '"%s",' "$tkr_gitdir"; fi; printf '"%s/objects","%s/refs","%s/logs"' "$tkr_common" "$tkr_common" "$tkr_common")]"`;
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
 // from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
 // untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever
@@ -257,12 +263,12 @@ export const codex = {
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // v1.65 T3: every flag the command builder below hardcodes (incl. codexMcpSuppressionFlags' -c/
-    // --disable and GITDIR_WRITABLE's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
+    // --disable and CODEX_GIT_GRANT's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
     hardcodedFlags: { binary: "codex", flags: ["--sandbox", "-a", "-s", "--model", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
     // CODEX_HOOK_TRUST (OBS-125) clears the per-worktree "Hooks need review" gate while keeping the sandbox.
-    headlessCommand: (promptFile, model, effort) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE}${codexEffortFlag(effort)} --model ${shq(model)} - < ${shq(promptFile)}`,
+    headlessCommand: (promptFile, model, effort) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${CODEX_GIT_GRANT}${codexEffortFlag(effort)} --model ${shq(model)} - < ${shq(promptFile)}`,
     // OBS-930: the visible pane runs the REAL TUI. Codex's TUI takes its prompt only as the [PROMPT]
     // positional (`codex --help`, 0.153.4 — no file/stdin form), so the launch inlines the file exactly
     // as the claude adapter does: the prompt is the LAST positional and every flag value is followed by
@@ -274,7 +280,7 @@ export const codex = {
     // OBS-930 (Linux): the inlined prompt is ONE argv string and Linux caps one at 131072 bytes, so a
     // prompt over promptArgvCeiling() returns null → worker-mode-fallback → the headless form (types.ts).
     interactiveCommand: (promptFile, model, effort) => promptFitsArgv(promptFile)
-        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
+        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${CODEX_GIT_GRANT}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
         : null,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model, a.effort) };

package/dist/adapters/types.d.ts

@@ -51,7 +51,7 @@ export interface AuthHealth {
     modelAuth?: Record<string, ModelAuth>;
     modelIdentities?: Record<string, string>;
     modelRetirements?: Record<string, ModelRetirement | null>;
-    codexCommit?: "protected" | "allowed" | "unknown";
+    codexCommit?: CodexCommitStatus;
     launchServices?: LaunchServicesRecord;
 }
 export interface LaunchServicesRecord {
@@ -59,6 +59,9 @@ export interface LaunchServicesRecord {
     start: string;
     advisory?: string;
 }
+/** allowed: linked branch commit landed, shared hooks/common root denied · protected: commit denied, controls
+ *  readable · escape: a unique hostile member was written · unknown: unreadable or contradictory receipts. */
+export type CodexCommitStatus = "allowed" | "protected" | "escape" | "unknown";
 export declare function modelAuthed(health: AuthHealth | undefined, model: string, allowUnverifiedModels?: boolean): boolean;
 export interface Invocation {
     command: string;

package/dist/cli/commands/doctor.js

@@ -15,6 +15,7 @@ import { HerdrDriver } from "../../drivers/herdr.js";
 import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
 import { recordCodexCommit } from "../../adapters/codex-commit-check.js";
+import { codex } from "../../adapters/codex.js";
 import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, observedSeat, preferRanks } from "../../route/preference.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { sh } from "../../run/git.js";
@@ -672,7 +673,8 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
         const h = health[a.id];
         // OBS-503: a crash-on-version verdict carries its reason in note — print it instead of the lie.
         const state = !h.installed ? (h.note ?? "not installed") : `${h.version ?? "installed"}${h.note ? ` (${h.note})` : ""}`;
-        const healthy = h.installed && (a.id !== kimi.id || h.authed);
+        // v2.6.6 T9 (K): a Codex sandbox escape is a BLOCKING security warning — never a passing row
+        const healthy = h.installed && (a.id !== kimi.id || h.authed) && !(a.id === codex.id && h.codexCommit === "escape");
         return alignedStatusRow(healthy ? "pass" : "fail", a.id, state);
     });
     const reviewDemotions = recentReviewDemotions(cwd);