threadkeeper 0.18.1__tar.gz → 0.18.3__tar.gz

{threadkeeper-0.18.1/threadkeeper.egg-info → threadkeeper-0.18.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: threadkeeper
-Version: 0.18.1
+Version: 0.18.3
 Summary: Multi-agent shared brain across Claude Code/Desktop, Codex, Antigravity CLI, Copilot, and VS Code. Cross-session memory, self-improving skill loops, inter-agent signaling — one local MCP server.
 Author: thread-keeper contributors
 License: MIT
@@ -313,6 +313,11 @@ servers. ~500 MB RSS versus ~1.3 GB for a full child. Heuristic for the
 parent: N≥2 modular independent units of ≥5 min each = spawn signal.
 Spawn also marks children with `THREADKEEPER_SPAWNED_CHILD=1`, so
 autonomous learning daemons cannot recursively start inside review forks.
+Codex children get the same isolation: `codex exec --ignore-user-config`
+with only the user's provider settings and thread-keeper entry carried over,
+and `enabled_tools` limited to the child's granted thread-keeper tools. Other
+MCP servers, plugins and hooks from `~/.codex/config.toml` never start inside
+a background child.
 
 A daemon in the foreground parent measures combined child RSS every 10 s;
 spawned children do not start their own `ps` polling loop, failed `ps` RSS

{threadkeeper-0.18.1 → threadkeeper-0.18.3}/README.md

@@ -269,6 +269,11 @@ servers. ~500 MB RSS versus ~1.3 GB for a full child. Heuristic for the
 parent: N≥2 modular independent units of ≥5 min each = spawn signal.
 Spawn also marks children with `THREADKEEPER_SPAWNED_CHILD=1`, so
 autonomous learning daemons cannot recursively start inside review forks.
+Codex children get the same isolation: `codex exec --ignore-user-config`
+with only the user's provider settings and thread-keeper entry carried over,
+and `enabled_tools` limited to the child's granted thread-keeper tools. Other
+MCP servers, plugins and hooks from `~/.codex/config.toml` never start inside
+a background child.
 
 A daemon in the foreground parent measures combined child RSS every 10 s;
 spawned children do not start their own `ps` polling loop, failed `ps` RSS

{threadkeeper-0.18.1 → threadkeeper-0.18.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "threadkeeper"
-version = "0.18.1"
+version = "0.18.3"
 description = "Multi-agent shared brain across Claude Code/Desktop, Codex, Antigravity CLI, Copilot, and VS Code. Cross-session memory, self-improving skill loops, inter-agent signaling — one local MCP server."
 requires-python = ">=3.11"
 authors = [{ name = "thread-keeper contributors" }]

{threadkeeper-0.18.1 → threadkeeper-0.18.3}/tests/test_adapters.py

@@ -476,9 +476,112 @@ def test_codex_spawn_argv_forwards_child_identity_to_its_mcp_server(
     ):
         assert key in names
     assert "THREADKEEPER_ROLE" not in names  # the host's role must not leak
+    assert "THREADKEEPER_REAL_GH" in names  # gh wrapper must reach real gh
     assert all("=" not in name for name in names)  # names only, no values
 
 
+def _codex_overrides(argv):
+    return [argv[i + 1] for i, arg in enumerate(argv[:-1]) if arg == "-c"]
+
+
+def _write_codex_config(path):
+    path.write_text(
+        'model = "gpt-6-sol"\n'
+        'model_reasoning_effort = "xhigh"\n'
+        'personality = "pragmatic"\n'
+        'notify = ["/Applications/Tool.app/notify"]\n'
+        '[model_providers.corp]\n'
+        'base_url = "https://llm.example/v1"\n'
+        '[mcp_servers.trello]\n'
+        'command = "trello-mcp"\n'
+        '[mcp_servers.thread-keeper]\n'
+        'command = "/opt/tk/python"\n'
+        'args = ["-m", "threadkeeper.server"]\n'
+        'tool_timeout_sec = 120\n'
+        '[mcp_servers.thread-keeper.env]\n'
+        'PYTHONPATH = "/opt/tk"\n'
+        'SECRET_TOKEN = "do-not-copy"\n'
+        'THREADKEEPER_FORCE_CID = "stale-cid"\n'
+        '[plugins."computer-use@openai-bundled"]\n'
+        'enabled = true\n',
+        encoding="utf-8",
+    )
+
+
+def test_codex_child_runs_without_the_user_codex_config(tmp_path, monkeypatch):
+    """Children get thread-keeper only, like Claude's --strict-mcp-config:
+    no other MCP server, plugin, hook or notify program from config.toml."""
+    pkg = _bootstrap(tmp_path, monkeypatch)
+    import threadkeeper.adapters.codex as codex_mod
+    monkeypatch.setattr(codex_mod.shutil, "which", lambda _bin: "/usr/local/bin/codex")
+    monkeypatch.setattr(codex_mod, "_supports_ignore_user_config", lambda _bin: True)
+    cfg = tmp_path / "config.toml"
+    _write_codex_config(cfg)
+    monkeypatch.setattr(pkg["codex"], "config_path", cfg)
+
+    argv = pkg["codex"].spawn_argv(
+        "research",
+        extra_allowed_tools=(
+            "Read,WebSearch,mcp__thread-keeper__broadcast,"
+            "mcp__thread-keeper__evolve_research_handoff"
+        ),
+    )
+
+    assert argv[:5] == [
+        "/usr/local/bin/codex", "--search", "exec", "--skip-git-repo-check",
+        "--ignore-user-config",
+    ]
+    overrides = _codex_overrides(argv)
+    text = "\n".join(overrides)
+    for expected in (
+        'model="gpt-6-sol"',
+        'model_reasoning_effort="xhigh"',
+        'model_providers.corp.base_url="https://llm.example/v1"',
+        'mcp_servers.thread-keeper.command="/opt/tk/python"',
+        'mcp_servers.thread-keeper.args=["-m", "threadkeeper.server"]',
+        "mcp_servers.thread-keeper.tool_timeout_sec=120",
+        'mcp_servers.thread-keeper.env.PYTHONPATH="/opt/tk"',
+        'mcp_servers.thread-keeper.env.PYTHONSAFEPATH="1"',
+        'mcp_servers.thread-keeper.enabled_tools=["broadcast", "evolve_research_handoff"]',
+    ):
+        assert expected in overrides, expected
+    for leaked in ("trello", "SECRET_TOKEN", "stale-cid", "computer-use", "notify", "personality"):
+        assert leaked not in text, leaked
+
+
+def test_codex_child_disables_other_servers_on_older_codex(tmp_path, monkeypatch):
+    pkg = _bootstrap(tmp_path, monkeypatch)
+    import threadkeeper.adapters.codex as codex_mod
+    monkeypatch.setattr(codex_mod.shutil, "which", lambda _bin: "/usr/local/bin/codex")
+    monkeypatch.setattr(codex_mod, "_supports_ignore_user_config", lambda _bin: False)
+    cfg = tmp_path / "config.toml"
+    _write_codex_config(cfg)
+    monkeypatch.setattr(pkg["codex"], "config_path", cfg)
+
+    argv = pkg["codex"].spawn_argv("audit", extra_allowed_tools="mcp__thread-keeper__note")
+
+    assert "--ignore-user-config" not in argv
+    overrides = _codex_overrides(argv)
+    assert "mcp_servers.trello.enabled=false" in overrides
+    assert not any(o.startswith("mcp_servers.thread-keeper.enabled=") for o in overrides)
+    assert 'mcp_servers.thread-keeper.enabled_tools=["note"]' in overrides
+
+
+def test_codex_child_synthesizes_a_thread_keeper_entry(tmp_path, monkeypatch):
+    import sys as _sys
+
+    pkg = _bootstrap(tmp_path, monkeypatch)
+    import threadkeeper.adapters.codex as codex_mod
+    monkeypatch.setattr(codex_mod.shutil, "which", lambda _bin: "/usr/local/bin/codex")
+    monkeypatch.setattr(codex_mod, "_supports_ignore_user_config", lambda _bin: True)
+    monkeypatch.setattr(pkg["codex"], "config_path", tmp_path / "missing.toml")
+
+    overrides = _codex_overrides(pkg["codex"].spawn_argv("audit"))
+
+    assert f"mcp_servers.thread-keeper.command={json.dumps(_sys.executable)}" in overrides
+    assert any(o.startswith("mcp_servers.thread-keeper.env.PYTHONPATH=") for o in overrides)
+
+
 def test_codex_iter_messages_filters_developer_turns(tmp_path, monkeypatch):
     pkg = _bootstrap(tmp_path, monkeypatch)
     fp = tmp_path / "rollout-2026-05-14T10-00-00.jsonl"

{threadkeeper-0.18.1 → threadkeeper-0.18.3}/tests/test_github_safety.py

@@ -101,3 +101,38 @@ def test_wrapped_gh_honors_shared_budget_cooldown(
 
     assert rc == gb.GITHUB_RATE_COOLDOWN_EXIT
     assert not capture.exists()
+
+
+def _exe(path, body):
+    path.write_text(body, encoding="utf-8")
+    path.chmod(0o700)
+    return path
+
+
+def test_real_gh_resolution_skips_the_safety_wrapper(tmp_path, monkeypatch):
+    """A Codex child's MCP server gets the wrapper-first PATH without the
+    wrapper variables. Resolving `gh` must not find the wrapper itself, which
+    used to re-run itself until the dedup gate timed out."""
+    from threadkeeper import github_safety
+
+    wrapper_dir = tmp_path / "gh-safe-tk_x"
+    real_dir = tmp_path / "bin"
+    wrapper_dir.mkdir()
+    real_dir.mkdir()
+    wrapper = _exe(
+        wrapper_dir / "gh",
+        "#!/bin/sh\nexec python -m threadkeeper.github_safety \"$@\"\n",
+    )
+    real = _exe(real_dir / "gh", "#!/bin/sh\necho real\n")
+    monkeypatch.delenv("THREADKEEPER_GH_WRAPPER_DIR", raising=False)
+    monkeypatch.setenv("PATH", f"{wrapper_dir}:{real_dir}")
+
+    monkeypatch.delenv("THREADKEEPER_REAL_GH", raising=False)
+    assert github_safety._resolve_real_gh() == str(real)
+
+    monkeypatch.setenv("THREADKEEPER_REAL_GH", str(wrapper))
+    assert github_safety._resolve_real_gh() == str(real)
+
+    monkeypatch.setenv("PATH", str(wrapper_dir))
+    assert github_safety._resolve_real_gh() == ""
+

threadkeeper-0.18.3/tests/test_hook_child_guard.py

@@ -0,0 +1,38 @@
+"""Session-protocol hooks stay silent inside spawned background children."""
+from __future__ import annotations
+
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+HOOKS = Path(__file__).resolve().parents[1] / "scripts" / "hooks"
+
+
+@pytest.mark.parametrize(
+    "script", ["tk-brief.sh", "tk-thread-nudge.sh", "tk-session-end.sh"],
+)
+def test_session_hooks_exit_before_work_in_spawned_children(tmp_path, script):
+    marker = tmp_path / "python-ran"
+    fake_python = tmp_path / "python"
+    fake_python.write_text(f"#!/bin/sh\ntouch {marker}\n", encoding="utf-8")
+    fake_python.chmod(0o700)
+    env = {
+        "PATH": os.environ.get("PATH", "/usr/bin:/bin"),
+        "HOME": str(tmp_path),
+        "THREADKEEPER_PYTHON": str(fake_python),
+        "THREADKEEPER_STATE_DIR": str(tmp_path / "state"),
+        "THREADKEEPER_SPAWNED_CHILD": "1",
+    }
+
+    proc = subprocess.run(
+        ["bash", str(HOOKS / script)],
+        input='{"session_id": "s1", "prompt": "hello"}',
+        capture_output=True, text=True, env=env, timeout=30,
+    )
+
+    assert proc.returncode == 0, proc.stderr
+    assert proc.stdout == ""
+    assert not marker.exists()
+    assert not (tmp_path / "state").exists()

threadkeeper-0.18.3/tests/test_spawn_child_env.py

@@ -0,0 +1,101 @@
+"""What a spawned child inherits and which CLI runs it."""
+from __future__ import annotations
+
+_FAKE_CID = "44445555-6666-7777-8888-999900001111"
+
+
+def _setup(mp_with_cid, monkeypatch, routed_cli="codex"):
+    pkg = mp_with_cid(_FAKE_CID)
+    import threadkeeper.identity as identity
+    import threadkeeper.spawn_config as spawn_config
+    import threadkeeper.tools.spawn as spawn_mod
+
+    monkeypatch.setattr(spawn_mod, "_claude_bin", lambda: "/bin/true")
+    monkeypatch.setattr(identity, "_active_cli", "claude")
+    monkeypatch.setattr(
+        spawn_config, "resolve_agent", lambda role, active_cli=None: routed_cli
+    )
+    monkeypatch.setattr(spawn_config, "resolve_model", lambda cli, role="": "")
+    launched: list[dict] = []
+
+    class _Popen:
+        def __init__(self, args, **kwargs):
+            launched.append({"args": list(args), "env": dict(kwargs.get("env") or {})})
+            self.pid = 4545
+
+    monkeypatch.setattr(spawn_mod.subprocess, "Popen", _Popen)
+    return pkg, spawn_mod, launched
+
+
+def _chosen_cli(pkg):
+    conn = pkg["db"].get_db()
+    try:
+        return conn.execute("SELECT chosen_cli FROM tasks").fetchone()[0]
+    finally:
+        conn.close()
+
+
+def test_explicit_claude_model_runs_on_claude(mp_with_cid, monkeypatch):
+    """`spawn(model="opus")` from a Codex-routed setup used to launch codex
+    with a Claude model, which the provider rejects at once."""
+    pkg, spawn_mod, launched = _setup(mp_with_cid, monkeypatch, routed_cli="codex")
+
+    out = spawn_mod.spawn(
+        prompt="implement the task", cwd=str(pkg["tmp"]), model="opus",
+        visible=False, capture_output=False,
+    )
+
+    assert out.startswith("ok task="), out
+    assert _chosen_cli(pkg) == "claude"
+    args = launched[0]["args"]
+    assert "--model" in args and args[args.index("--model") + 1] == "opus"
+
+
+def test_explicit_cli_with_a_foreign_model_is_refused(mp_with_cid, monkeypatch):
+    pkg, spawn_mod, launched = _setup(mp_with_cid, monkeypatch)
+
+    out = spawn_mod._spawn_impl(
+        prompt="x", cwd=str(pkg["tmp"]), cli="codex", model="sonnet",
+        visible=False, capture_output=False,
+    )
+
+    assert out == "ERR model_cli_mismatch model=sonnet cli=codex"
+    assert launched == []
+
+
+def test_child_env_drops_the_host_role(mp_with_cid, monkeypatch):
+    """The daemon host runs with THREADKEEPER_ROLE=host; a child that kept it
+    would start its MCP server believing it is the host."""
+    pkg, spawn_mod, launched = _setup(mp_with_cid, monkeypatch, routed_cli="claude")
+    monkeypatch.setenv("THREADKEEPER_ROLE", "host")
+
+    out = spawn_mod.spawn(
+        prompt="x", cwd=str(pkg["tmp"]), visible=False, capture_output=False,
+    )
+
+    assert out.startswith("ok task="), out
+    env = launched[0]["env"]
+    assert "THREADKEEPER_ROLE" not in env
+    assert env["THREADKEEPER_SPAWNED_CHILD"] == "1"
+
+
+def test_child_preamble_skips_the_user_session_protocol(mp_with_cid, monkeypatch):
+    pkg, spawn_mod, launched = _setup(mp_with_cid, monkeypatch, routed_cli="claude")
+
+    spawn_mod.spawn(prompt="x", cwd=str(pkg["tmp"]), visible=False, capture_output=False)
+
+    args = launched[0]["args"]
+    preamble = args[args.index("--append-system-prompt") + 1]
+    assert "not a user session" in preamble
+    assert "session_end" in preamble
+
+
+def test_model_home_cli():
+    from threadkeeper.spawn_config import model_home_cli
+
+    assert model_home_cli("opus") == "claude"
+    assert model_home_cli("claude-sonnet-5") == "claude"
+    assert model_home_cli("gpt-5.6-terra") == "codex"
+    assert model_home_cli("o3") == "codex"
+    assert model_home_cli("gemini-3-pro") == ""
+    assert model_home_cli("") == ""

{threadkeeper-0.18.1 → threadkeeper-0.18.3}/tests/test_spawn_slim.py

@@ -9,7 +9,6 @@ from __future__ import annotations
 import json
 from pathlib import Path
 
-import pytest
 
 
 _FAKE_CID = "11112222-3333-4444-5555-666677778888"
@@ -265,18 +264,39 @@ def test_claude_large_prompt_uses_stdin_file(mp_with_cid, monkeypatch):
     assert mode == 0o600, f"expected 0600, got {oct(mode)}"
 
 
-def test_spawn_slim_falls_back_to_full_config_when_unable(tmp_path, monkeypatch):
-    """If _build_slim_mcp_config returns None (e.g. write error), spawn()
-    must NOT crash — it just runs without slim flags."""
-    # We unit-test by patching _build_slim_mcp_config to return None and
-    # then checking spawn doesn't append --mcp-config to the cmd. But the
-    # whole flow runs subprocess.Popen which we don't want in tests. Skip
-    # full integration — the conditional branch in spawn() is plain
-    # if-statement, no need for deep coverage.
-    pytest.skip(
-        "spawn() invokes claude CLI; slim-fallback path is covered by "
-        "inspection of the conditional branch"
+def test_spawn_refuses_when_the_slim_config_cannot_be_written(
+    mp_with_cid, monkeypatch,
+):
+    """A slim child whose MCP file cannot be written must not silently run
+    with the user's full MCP config (every configured server)."""
+    pkg = mp_with_cid(_FAKE_CID)
+    import threadkeeper.identity as identity
+    import threadkeeper.spawn_config as spawn_config
+    import threadkeeper.tools.spawn as spawn_mod
+
+    monkeypatch.setattr(spawn_mod, "_claude_bin", lambda: "/bin/true")
+    monkeypatch.setattr(identity, "_active_cli", "claude")
+    monkeypatch.setattr(
+        spawn_config, "resolve_agent", lambda role, active_cli=None: "claude"
     )
+    monkeypatch.setattr(spawn_mod, "_build_slim_mcp_config", lambda *a, **k: None)
+    launched = []
+    monkeypatch.setattr(
+        spawn_mod.subprocess, "Popen", lambda *a, **k: launched.append(a),
+    )
+
+    out = spawn_mod.spawn(
+        prompt="x", cwd=str(pkg["tmp"]), slim=True, visible=False,
+        capture_output=False,
+    )
+
+    assert out == "ERR slim_mcp_config_failed"
+    assert launched == []
+    conn = pkg["db"].get_db()
+    try:
+        assert conn.execute("SELECT COUNT(*) FROM tasks").fetchone()[0] == 0
+    finally:
+        conn.close()
 
 
 def test_review_thread_uses_slim_by_default(mp_with_cid, monkeypatch):

{threadkeeper-0.18.1 → threadkeeper-0.18.3}/threadkeeper/adapters/base.py

@@ -37,8 +37,35 @@ CHILD_MCP_ENV_KEYS: tuple[str, ...] = (
     "THREADKEEPER_CURATOR_PASS_ID",
     "THREADKEEPER_CURATOR_SNAPSHOT_DIR",
     "THREADKEEPER_EGRESS_CONSUMER",
+    # A privileged child's PATH starts with the gh safety wrapper; its MCP
+    # server needs these to reach the real gh instead of looping on itself.
+    "THREADKEEPER_GH_WRAPPER_DIR",
+    "THREADKEEPER_REAL_GH",
 )
 
+# Environment a user's thread-keeper MCP entry may carry into a spawned
+# child's own MCP config: package discovery plus thread-keeper knobs. Anything
+# else in that entry (credentials for other tools) stays out of the child.
+CHILD_MCP_ENTRY_ENV_ALLOW = frozenset({
+    "PYTHONPATH", "PYTHONSAFEPATH", "VIRTUAL_ENV", "PYTHONHOME",
+})
+CHILD_MCP_ENTRY_ENV_PREFIXES = ("THREADKEEPER_",)
+
+
+def child_mcp_entry_env(env: dict | None) -> dict[str, str]:
+    """Filter a thread-keeper MCP entry's env for a spawned child's config.
+
+    Per-run identity keys are dropped: the child's live values must win.
+    """
+    return {
+        str(k): str(v) for k, v in (env or {}).items()
+        if (
+            k in CHILD_MCP_ENTRY_ENV_ALLOW
+            or any(str(k).startswith(p) for p in CHILD_MCP_ENTRY_ENV_PREFIXES)
+        )
+        and k not in CHILD_MCP_ENV_KEYS
+    }
+
 
 def find_cli_executable(*names: str) -> str:
     """Find a CLI even when a sandboxed macOS app has a minimal PATH."""

{threadkeeper-0.18.1 → threadkeeper-0.18.3}/threadkeeper/adapters/codex.py

@@ -17,12 +17,14 @@ import os
 import re
 import shutil
 import subprocess
+import sys
 from datetime import datetime
 from pathlib import Path
 from typing import Iterator
 
 from .base import (
-    CHILD_MCP_ENV_KEYS, CLIAdapter, NormalizedMessage, find_cli_executable,
+    CHILD_MCP_ENV_KEYS, CLIAdapter, NormalizedMessage, child_mcp_entry_env,
+    find_cli_executable,
 )
 from ..config_io import mutate_text_file
 
@@ -156,6 +158,92 @@ def _approval_blocks(name: str) -> str:
     return "\n".join(lines) + "\n"
 
 
+# A spawned child runs without the rest of ~/.codex/config.toml (see
+# spawn_argv), but it still needs the user's provider and account settings,
+# and their default model/effort for roles that do not pin their own.
+_CHILD_CARRIED_CONFIG_KEYS = (
+    "model", "model_reasoning_effort", "model_provider", "model_providers",
+    "openai_base_url", "forced_login_method", "forced_chatgpt_workspace_id",
+    "cli_auth_credentials_store",
+)
+_THREAD_KEEPER_ENTRY_KEYS = (
+    "command", "args", "cwd", "startup_timeout_sec", "startup_timeout_ms",
+    "tool_timeout_sec",
+)
+_BARE_KEY_RE = re.compile(r"^[A-Za-z0-9_-]+$")
+_IGNORE_USER_CONFIG_SUPPORT: dict[str, bool] = {}
+
+
+def _toml_key(key: str) -> str:
+    return key if _BARE_KEY_RE.fullmatch(key) else json.dumps(key)
+
+
+def _toml_literal(value) -> str | None:
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)):
+        return repr(value)
+    if isinstance(value, str):
+        return json.dumps(value)
+    if isinstance(value, list):
+        items = [_toml_literal(item) for item in value]
+        if any(item is None for item in items):
+            return None
+        return "[" + ", ".join(items) + "]"
+    return None  # dates and other exotic values are not carried
+
+
+def _config_overrides(prefix: str, value) -> list[str]:
+    """`-c` strings that recreate one config value; tables are flattened."""
+    if isinstance(value, dict):
+        out: list[str] = []
+        for key, item in value.items():
+            out += _config_overrides(f"{prefix}.{_toml_key(str(key))}", item)
+        return out
+    literal = _toml_literal(value)
+    return [] if literal is None else [f"{prefix}={literal}"]
+
+
+def _thread_keeper_entry_overrides(entry: dict) -> list[str]:
+    """The user's thread-keeper MCP entry, minus env the child should not get.
+
+    Without an entry the child runs the same interpreter and package as the
+    spawning server, like the synthesized slim config for Claude children.
+    """
+    command = entry.get("command")
+    if not isinstance(command, str) or not command.strip():
+        entry = {
+            "command": sys.executable,
+            "args": ["-m", "threadkeeper.server"],
+            "env": {"PYTHONPATH": str(Path(__file__).resolve().parents[2])},
+        }
+    prefix = "mcp_servers.thread-keeper"
+    out: list[str] = []
+    for key in _THREAD_KEEPER_ENTRY_KEYS:
+        if key in entry:
+            out += _config_overrides(f"{prefix}.{key}", entry[key])
+    for key, value in child_mcp_entry_env(entry.get("env")).items():
+        out.append(f"{prefix}.env.{_toml_key(key)}={json.dumps(value)}")
+    return out
+
+
+def _supports_ignore_user_config(bin_path: str) -> bool:
+    """Whether this codex build has `exec --ignore-user-config` (cached)."""
+    cached = _IGNORE_USER_CONFIG_SUPPORT.get(bin_path)
+    if cached is not None:
+        return cached
+    try:
+        probe = subprocess.run(
+            [bin_path, "exec", "--help"], capture_output=True, text=True,
+            timeout=10, check=False,
+        )
+    except Exception:
+        return False  # not cached: a later spawn probes again
+    supported = "--ignore-user-config" in (probe.stdout or "") + (probe.stderr or "")
+    _IGNORE_USER_CONFIG_SUPPORT[bin_path] = supported
+    return supported
+
+
 def _parse_toml(body: str) -> dict:
     try:
         import tomllib  # py3.11+
@@ -346,6 +434,12 @@ class CodexAdapter(CLIAdapter):
         thread-keeper identity variables in ``CHILD_MCP_ENV_KEYS`` are
         forwarded by name through ``env_vars``.
 
+        The child runs with ``--ignore-user-config`` when the codex build has
+        it: only the user's provider/account keys and their thread-keeper
+        entry are carried over, so no other MCP server, plugin, or hook starts
+        inside an autonomous child. ``enabled_tools`` then exposes exactly the
+        granted thread-keeper tools.
+
         `extra_allowed_tools` is the child's full Claude-style allowlist.
         `codex exec` runs with approval policy "never", so a thread-keeper
         write tool that is not pre-approved fails with "MCP tool call requires
@@ -371,29 +465,54 @@ class CodexAdapter(CLIAdapter):
         if {"websearch", "webfetch"} & requested_tools:
             argv.append("--search")
         argv += ["exec", "--skip-git-repo-check"]
+        user_config = _read_toml(self.config_path)
+        overrides: list[str] = []
+        # Like Claude's --strict-mcp-config: the child gets thread-keeper and
+        # nothing else from the user's setup. With the user config loaded,
+        # every configured MCP server, plugin (computer use, browser, Drive)
+        # and hook started inside autonomous children, including the web
+        # researcher that reads untrusted pages.
+        if _supports_ignore_user_config(bin_path):
+            argv.append("--ignore-user-config")
+            for key in _CHILD_CARRIED_CONFIG_KEYS:
+                if key in user_config:
+                    overrides += _config_overrides(_toml_key(key), user_config[key])
+            entry = (user_config.get("mcp_servers") or {}).get("thread-keeper")
+            overrides += _thread_keeper_entry_overrides(
+                entry if isinstance(entry, dict) else {}
+            )
+        else:
+            for name in (user_config.get("mcp_servers") or {}):
+                if name != "thread-keeper":
+                    overrides.append(f"mcp_servers.{_toml_key(name)}.enabled=false")
         # Codex launches configured stdio MCP servers from the agent cwd.  A
         # repository checkout can therefore shadow the installed package used
         # by thread-keeper's MCP entry.  Scope safe-path mode to the MCP server
         # only; shell/test Python processes in the child keep normal semantics.
-        argv += [
-            "-c",
-            'mcp_servers.thread-keeper.env.PYTHONSAFEPATH="1"',
-        ]
+        safepath = 'mcp_servers.thread-keeper.env.PYTHONSAFEPATH="1"'
+        if safepath not in overrides:
+            overrides.append(safepath)
         # Codex also starts MCP servers with a scrubbed environment, so the
         # child's thread-keeper server would not know it is this child: no
         # forced cid, write origin, or Curator pass, and every report write
         # was refused as unauthorized. Forward those names from the child's
         # own environment; the values never land on argv.
-        argv += [
-            "-c",
+        overrides.append(
             "mcp_servers.thread-keeper.env_vars="
-            + json.dumps(list(CHILD_MCP_ENV_KEYS)),
+            + json.dumps(list(CHILD_MCP_ENV_KEYS))
+        )
+        # Expose exactly the granted tools, as --allowedTools does for Claude;
+        # approvals alone left every tool the user pre-approved callable.
+        granted = _granted_thread_keeper_tools(extra_allowed_tools)
+        overrides.append(
+            "mcp_servers.thread-keeper.enabled_tools=" + json.dumps(granted)
+        )
+        overrides += [
+            f'mcp_servers.thread-keeper.tools.{tool}.approval_mode="approve"'
+            for tool in granted
         ]
-        for tool in _granted_thread_keeper_tools(extra_allowed_tools):
-            argv += [
-                "-c",
-                f'mcp_servers.thread-keeper.tools.{tool}.approval_mode="approve"',
-            ]
+        for override in overrides:
+            argv += ["-c", override]
         if model:
             argv += ["-m", model]
         if effort:

{threadkeeper-0.18.1 → threadkeeper-0.18.3}/threadkeeper/github_safety.py

@@ -170,17 +170,34 @@ def sanitize_gh_body_args(args: Sequence[str]) -> tuple[list[str], list[Path]]:
     return out, cleanup
 
 
+def _is_safety_wrapper(path: str) -> bool:
+    """Whether `path` is one of spawn()'s gh wrapper scripts, not gh itself."""
+    try:
+        with open(path, "rb") as fh:
+            return b"threadkeeper.github_safety" in fh.read(512)
+    except OSError:
+        return False
+
+
 def _resolve_real_gh() -> str:
+    """The real gh binary, never a safety wrapper.
+
+    A child's MCP server can inherit the wrapper-first PATH without
+    THREADKEEPER_REAL_GH (Codex scrubs MCP server environments). Taking the
+    first `gh` on PATH then found the wrapper itself, which re-ran itself
+    until the caller's timeout, so every issue dedup check failed.
+    """
     env = os.environ.get("THREADKEEPER_REAL_GH", "").strip()
-    if env:
+    if env and not _is_safety_wrapper(env):
         return env
     wrapper_dir = os.environ.get("THREADKEEPER_GH_WRAPPER_DIR", "").strip()
-    path_parts = [
-        p for p in os.environ.get("PATH", "").split(os.pathsep)
-        if p and Path(p) != Path(wrapper_dir)
-    ]
-    found = shutil.which("gh", path=os.pathsep.join(path_parts))
-    return found or ""
+    for part in os.environ.get("PATH", "").split(os.pathsep):
+        if not part or (wrapper_dir and Path(part) == Path(wrapper_dir)):
+            continue
+        found = shutil.which("gh", path=part)
+        if found and not _is_safety_wrapper(found):
+            return found
+    return ""
 
 
 def run_wrapped_gh(args: Sequence[str], real_gh: str | None = None) -> int: