wade-cli 0.53.0__tar.gz → 0.54.0__tar.gz

{wade_cli-0.53.0 → wade_cli-0.54.0}/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://conventionalcommits.org/).
 
+## [v0.54.0] — 2026-08-31
+
+### Features
+
+- enable Codex implementation network access by default (#475) (0679c81)
+
+## [v0.53.1] — 2026-08-31
+
+### Bug Fixes
+
+- relaunch Codex with implementation network policy after plan handoff (#473) (202018b)
+
 ## [v0.53.0] — 2026-08-31
 
 ### Features

{wade_cli-0.53.0 → wade_cli-0.54.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: wade-cli
-Version: 0.53.0
+Version: 0.54.0
 Summary: WADE — Workflow for AI-Driven Engineering
 Project-URL: Homepage, https://github.com/ivanviragine/wade
 Project-URL: Repository, https://github.com/ivanviragine/wade
@@ -276,7 +276,7 @@ These are invoked by the AI during a session — you normally don't run them by
 | `wade plan-session done <plan_dir>` | Finalize a planning session |
 | `wade deps-session check` | Verify the detached dependency-analysis runtime before writing output or staging a knowledge vote |
 
-Most workflow commands accept `--ai <tool>`, `--model <model>`, `--effort <level>`, `--permission-mode <tier>`, and `--yolo` to override configured defaults. `plan`, `implement`, and `review pr-comments` accept repeatable `--skill` and `--review-skill` methodology bindings plus `--refresh-skills` for an existing frozen session; `implement-batch` forwards the same binding request to every child session. Standalone plan/code/batch review and `task deps` accept repeatable `--skill`. `implement`, `review pr-comments`, and the `wade <N>` shorthand also accept `--network` / `--no-network` (see [Codex sandbox](#codex-sandbox--network-policy)); the shorthand forwards the flag to whichever session it routes to. `implement` additionally supports `--detach` (new terminal tab), `--cd` (print worktree path only), and `--base <branch>` (see [Planning & base branches](#planning--base-branches)).
+Most workflow commands accept `--ai <tool>`, `--model <model>`, `--effort <level>`, `--permission-mode <tier>`, and `--yolo` to override configured defaults. `plan`, `implement`, and `review pr-comments` accept repeatable `--skill` and `--review-skill` methodology bindings plus `--refresh-skills` for an existing frozen session; `implement-batch` forwards the same binding request to every child session. Standalone plan/code/batch review and `task deps` accept repeatable `--skill`. `implement`, `implement-batch`, `review pr-comments`, and the `wade <N>` shorthand also accept `--network` / `--no-network` (see [Codex sandbox](#codex-sandbox--network-policy)); batch and shorthand forward an explicit flag to the child session they launch. `implement` additionally supports `--detach` (new terminal tab), `--cd` (print worktree path only), and `--base <branch>` (see [Planning & base branches](#planning--base-branches)).
 
 ## Planning & base branches
 
@@ -707,15 +707,17 @@ needed, and it only affects Codex (every other tool ignores it).
 above makes **local** git work (stage, commit, stash, ref updates, and the
 local legs of `sync`/`done`) succeed with **network off**. Only operations that
 reach the network — `git fetch` (hence `sync`) and `git push` (hence the network
-leg of `done`) — need network access, which is **disabled by default**. Enable
-it explicitly per invocation with `--network` on `wade implement` / `wade review
-pr-comments`, or in `.wade.yml`:
+leg of `done`) — need network access. It is **enabled by default** for the
+interactive lifecycle commands `wade implement` (including its batch children)
+and `wade review pr-comments`, because their readiness, sync, and completion
+steps require GitHub. Choose offline operation explicitly with `--no-network`,
+or in `.wade.yml`:
 
 ```yaml
 ai:
-  network_access: true          # default for the interactive session commands
+  network_access: false         # offline opt-out for interactive session commands
   implement:
-    network_access: false       # per-command override wins
+    network_access: true        # per-command override wins
 ```
 
 The policy applies to the **interactive session commands** — `wade implement`
@@ -725,10 +727,21 @@ may need `fetch`/`push`. The headless/analytical paths (`plan`, `deps`,
 they never fetch or push, so `ai.network_access` does not apply to them and no
 flag enables it there. Precedence for the commands that honor it is
 `--network`/`--no-network` > `ai.<command>.network_access` >
-`ai.network_access` > **off**. WADE always passes an explicit pin, so an ambient
+`ai.network_access` > **on for `implement` and `review_pr_comments`, otherwise
+off**. WADE always passes an explicit pin, so an ambient
 `network_access = true` in your own Codex `config.toml` can never silently
-enable network for a WADE-managed sandbox. Enabling network never disables the
-sandbox and never changes approval-policy semantics.
+enable network for a WADE-managed sandbox. Enabling network permits outbound
+access for commands inside the Codex workspace-write sandbox; it does not
+disable filesystem sandboxing or change approval-policy semantics.
+
+An accepted single-issue plan handoff starts implementation from a planning
+session that is always network-off. When both the planning tool and resolved
+implementation tool are Codex and the implementation policy resolves to enabled,
+WADE starts a fresh detached Codex context with network explicitly enabled;
+reusing the planner process would retain its immutable network-off sandbox. If
+WADE cannot open that detached context, the handoff fails rather than reporting
+an implementation session ready. Open a new host terminal and run the displayed
+`wade implement <issue> --network` command to continue with the required policy.
 
 ### Session readiness and least-privilege remediation
 
@@ -789,8 +802,9 @@ timeout still counts as a bounded review attempt, so the review/fix loop cannot
 run forever.
 
 For Codex, keep `--sandbox workspace-write`; WADE/crossby add only the linked
-worktree's private/common Git metadata directories, and you must enable
-`network_access` explicitly for implementation/review sessions that need GitHub.
+worktree's private/common Git metadata directories. Implementation and PR-comment
+sessions have network access by default for their GitHub lifecycle; use
+`--no-network` or `ai.network_access: false` when an offline sandbox is required.
 For Claude Code and Cursor, allowlist the worktree/Git metadata paths and only
 the GitHub domains needed by the session rather than choosing unrestricted shell
 access. Copilot and VS Code need network plus usable `gh` credentials in their

{wade_cli-0.53.0 → wade_cli-0.54.0}/README.md

@@ -240,7 +240,7 @@ These are invoked by the AI during a session — you normally don't run them by
 | `wade plan-session done <plan_dir>` | Finalize a planning session |
 | `wade deps-session check` | Verify the detached dependency-analysis runtime before writing output or staging a knowledge vote |
 
-Most workflow commands accept `--ai <tool>`, `--model <model>`, `--effort <level>`, `--permission-mode <tier>`, and `--yolo` to override configured defaults. `plan`, `implement`, and `review pr-comments` accept repeatable `--skill` and `--review-skill` methodology bindings plus `--refresh-skills` for an existing frozen session; `implement-batch` forwards the same binding request to every child session. Standalone plan/code/batch review and `task deps` accept repeatable `--skill`. `implement`, `review pr-comments`, and the `wade <N>` shorthand also accept `--network` / `--no-network` (see [Codex sandbox](#codex-sandbox--network-policy)); the shorthand forwards the flag to whichever session it routes to. `implement` additionally supports `--detach` (new terminal tab), `--cd` (print worktree path only), and `--base <branch>` (see [Planning & base branches](#planning--base-branches)).
+Most workflow commands accept `--ai <tool>`, `--model <model>`, `--effort <level>`, `--permission-mode <tier>`, and `--yolo` to override configured defaults. `plan`, `implement`, and `review pr-comments` accept repeatable `--skill` and `--review-skill` methodology bindings plus `--refresh-skills` for an existing frozen session; `implement-batch` forwards the same binding request to every child session. Standalone plan/code/batch review and `task deps` accept repeatable `--skill`. `implement`, `implement-batch`, `review pr-comments`, and the `wade <N>` shorthand also accept `--network` / `--no-network` (see [Codex sandbox](#codex-sandbox--network-policy)); batch and shorthand forward an explicit flag to the child session they launch. `implement` additionally supports `--detach` (new terminal tab), `--cd` (print worktree path only), and `--base <branch>` (see [Planning & base branches](#planning--base-branches)).
 
 ## Planning & base branches
 
@@ -671,15 +671,17 @@ needed, and it only affects Codex (every other tool ignores it).
 above makes **local** git work (stage, commit, stash, ref updates, and the
 local legs of `sync`/`done`) succeed with **network off**. Only operations that
 reach the network — `git fetch` (hence `sync`) and `git push` (hence the network
-leg of `done`) — need network access, which is **disabled by default**. Enable
-it explicitly per invocation with `--network` on `wade implement` / `wade review
-pr-comments`, or in `.wade.yml`:
+leg of `done`) — need network access. It is **enabled by default** for the
+interactive lifecycle commands `wade implement` (including its batch children)
+and `wade review pr-comments`, because their readiness, sync, and completion
+steps require GitHub. Choose offline operation explicitly with `--no-network`,
+or in `.wade.yml`:
 
 ```yaml
 ai:
-  network_access: true          # default for the interactive session commands
+  network_access: false         # offline opt-out for interactive session commands
   implement:
-    network_access: false       # per-command override wins
+    network_access: true        # per-command override wins
 ```
 
 The policy applies to the **interactive session commands** — `wade implement`
@@ -689,10 +691,21 @@ may need `fetch`/`push`. The headless/analytical paths (`plan`, `deps`,
 they never fetch or push, so `ai.network_access` does not apply to them and no
 flag enables it there. Precedence for the commands that honor it is
 `--network`/`--no-network` > `ai.<command>.network_access` >
-`ai.network_access` > **off**. WADE always passes an explicit pin, so an ambient
+`ai.network_access` > **on for `implement` and `review_pr_comments`, otherwise
+off**. WADE always passes an explicit pin, so an ambient
 `network_access = true` in your own Codex `config.toml` can never silently
-enable network for a WADE-managed sandbox. Enabling network never disables the
-sandbox and never changes approval-policy semantics.
+enable network for a WADE-managed sandbox. Enabling network permits outbound
+access for commands inside the Codex workspace-write sandbox; it does not
+disable filesystem sandboxing or change approval-policy semantics.
+
+An accepted single-issue plan handoff starts implementation from a planning
+session that is always network-off. When both the planning tool and resolved
+implementation tool are Codex and the implementation policy resolves to enabled,
+WADE starts a fresh detached Codex context with network explicitly enabled;
+reusing the planner process would retain its immutable network-off sandbox. If
+WADE cannot open that detached context, the handoff fails rather than reporting
+an implementation session ready. Open a new host terminal and run the displayed
+`wade implement <issue> --network` command to continue with the required policy.
 
 ### Session readiness and least-privilege remediation
 
@@ -753,8 +766,9 @@ timeout still counts as a bounded review attempt, so the review/fix loop cannot
 run forever.
 
 For Codex, keep `--sandbox workspace-write`; WADE/crossby add only the linked
-worktree's private/common Git metadata directories, and you must enable
-`network_access` explicitly for implementation/review sessions that need GitHub.
+worktree's private/common Git metadata directories. Implementation and PR-comment
+sessions have network access by default for their GitHub lifecycle; use
+`--no-network` or `ai.network_access: false` when an offline sandbox is required.
 For Claude Code and Cursor, allowlist the worktree/Git metadata paths and only
 the GitHub domains needed by the session rather than choosing unrestricted shell
 access. Copilot and VS Code need network plus usable `gh` credentials in their

{wade_cli-0.53.0 → wade_cli-0.54.0}/docs/dev/architecture.md

@@ -478,16 +478,23 @@ review detached/inline launches (`implementation_service/core.py`,
 `working_dir` with network **off** for their worktree-capable paths.
 
 **Filesystem writes and network are independent axes.** The `working_dir` grant
-makes local git work under `network_access=False` (the default). Only
-`git fetch`/`git push` (the network legs of `sync`/`done`) need
-`network_access=True`. WADE resolves a `network_access: bool` through
-`resolve_network_access()` (CLI `--network`/`--no-network` > command config >
-global `ai.network_access` > **False**) and **always passes it explicitly** to
-the builder, so an ambient `network_access = true` in the user's Codex
-`config.toml` can never silently enable network for a WADE-managed sandbox. Only
-Codex acts on either value — crossby capability-gates every other tool via
-`supports_network_access` — and resume re-resolves both fresh from current config
-(a launch-time OS concern, not persisted session state).
+makes local Git metadata writes work under `network_access=False`. GitHub API
+calls — including readiness's `gh api user` and review-data fetch/resolve — and
+remote Git operations (`git fetch`/`git push`, the network legs of `sync`/`done`)
+need `network_access=True`. For `implement` and `review_pr_comments`, WADE
+resolves `network_access: bool` through `resolve_network_access()` (CLI
+`--network`/`--no-network` > command config > global `ai.network_access` >
+**enabled by default**). Planning, dependency analysis, bounded reviews, and
+every command outside `NETWORK_ENABLED_BY_DEFAULT_COMMANDS` are forcibly
+disabled regardless of CLI or configuration. WADE
+**always passes it explicitly** to the builder, so an ambient
+`network_access = true` in the user's Codex `config.toml` can never silently
+change a WADE-managed sandbox. Only Codex acts on either value — crossby
+capability-gates every other tool via `supports_network_access` — and resume
+re-resolves both fresh from current config (a launch-time OS concern, not
+persisted session state). Network access permits outbound connections inside the
+workspace-write sandbox; it neither widens the filesystem sandbox nor changes
+approval policy.
 
 The **explicit** `--network`/`--no-network` override (the tri-state
 `bool | None`, not the resolved bool) is threaded through every session **handoff**
@@ -499,6 +506,17 @@ picks (implement / batch / review). `None` (unset) still re-resolves per the
 routed command's own config, matching how a non-explicit `permission_mode` is
 threaded.
 
+Planning itself is always network-off, including when it later offers an
+accepted single-issue implementation handoff. The internal `plan_handoff`
+intent keeps implementation-network resolution at `implementation_service.start`.
+If that handoff originates in Codex, resolves the implementation tool to Codex,
+and resolves network access to enabled, implementation must create a fresh
+detached Codex launch with an explicit `network_access=True` pin. It cannot reuse
+the planner's immutable network-off sandbox. If the detached launch cannot be
+created, the handoff fails closed and prints `wade implement <issue> --network`
+for the user to run from a new host terminal; it must not fall back to an inline
+or nested agent. All other nested-agent starts retain the ordinary launch guard.
+
 ### Phase-aware session readiness (#462)
 
 `check_service.check_session_readiness()` applies the declarative
@@ -939,7 +957,7 @@ exactly as before #448. See knowledge `cc91cd11` for the generalized principle.
 
 **Model complexity mapping**: The `models` section maps AI tool names to complexity-tiered model IDs (`easy`, `medium`, `complex`, `very_complex`). When `wade implement` is invoked, the service reads the `complexity:X` label from the issue (falling back to `## Complexity` in the body), maps it to the appropriate configured model, and passes it as `--model` to the AI tool — unless the user explicitly passed `--model` themselves.
 
-**Per-command AI tool and model overrides**: The `ai` section supports `plan`, `deps`, `implement`, `review_plan`, `review_implementation`, `review_batch`, and `review_pr_comments` sub-sections (`AI_COMMAND_NAMES` in `models/config.py`), with optional `tool`, `model`, `mode`, `effort`, `enabled`, `yolo`, `permission_mode`, `network_access`, and `timeout` keys as applicable. `network_access` (global `ai.network_access` or per-command, default **False**) is the Codex sandbox network pin resolved by `resolve_network_access()` — see the "Codex sandboxed-worktree git writes & network policy" section above. `timeout` bounds a headless subprocess (seconds). When **unset**, the review/deps services compute the budget with `effective_timeout` (`delegation_service.py`, #366): it scales from **payload bytes + reasoning effort** — `scaled_timeout` starts at a **600s floor** (`TIMEOUT_FLOOR`, covers CLI cold-start + a small high-effort run), adds ~0.0075 s/byte of prompt, multiplies high/xhigh/max effort by 1.5–1.75×, and clamps to a **1500s ceiling** (`TIMEOUT_CEILING`). A headless timeout is **not** discarded: `run` (`utils/process.py`) decodes and reattaches the partial stdout (bytes even under `text=True`), `_delegate_headless` returns it as `feedback` with `DelegationResult.timed_out=True`, and wade **retries once** at a longer budget (`extended_timeout`, 1.5×) — bounding the *sum* of both legs to `TOTAL_TIMEOUT_CAP` (`TIMEOUT_CEILING + TIMEOUT_CEILING * TIMEOUT_RETRY_MULTIPLIER`, ~3750s / 62.5 min) so the worst case is predictable while the retry always gets the full multiplier, never a shorter budget than the attempt that just timed out (#366 review). The pre-launch advisory — now also printed by `deps_service.analyze_deps` before a headless run, not just the review commands (#366 review) — announces that worst-case total. A crash (`CommandError` / non-zero exit) is never retried and never flagged `timed_out`. Setting `ai.<cmd>.timeout` **explicitly** is a deliberate override: it is honored verbatim and **bypasses scaling and the retry math** — the escape hatch for orchestrators with a hard tool-timeout (set it below the harness limit). The fallback chain (tool/model) is: CLI `--ai`/`--model` flag -> command-specific config -> global `default_tool`. This is implemented in `ProjectConfig.get_ai_tool(command)` and `ProjectConfig.get_model(command)`. When `mode` is omitted, `review_plan` and `review_implementation` default to `prompt`, while `review_batch` defaults to `interactive`. `review_pr_comments` (#389) governs the **auto-launched review session** (post-`done` "Wait for reviews" → comments land → `review_service.start`): it resolves that session's tool, model, effort, and autonomy tier under its own key rather than inheriting `ai.implement.*`. The inherited implementation-session `tool` / `model` / `permission_mode` are honored only when the user set them *explicitly* (`--ai` / `--model` / `--permission-mode` / `--yolo`); the implementation flow forwards its already-*resolved* concrete values (never `None`), which would otherwise short-circuit the resolvers and shadow `ai.review_pr_comments` — so a merely config/default-derived value is dropped and the review config (then global `ai.*`) governs.
+**Per-command AI tool and model overrides**: The `ai` section supports `plan`, `deps`, `implement`, `review_plan`, `review_implementation`, `review_batch`, and `review_pr_comments` sub-sections (`AI_COMMAND_NAMES` in `models/config.py`), with optional `tool`, `model`, `mode`, `effort`, `enabled`, `yolo`, `permission_mode`, `network_access`, and `timeout` keys as applicable. `network_access` (global `ai.network_access` or per-command) is the Codex sandbox network pin resolved by `resolve_network_access()`: it defaults to **True** for `implement` and `review_pr_comments`, whose lifecycle requires GitHub, and **False** for every other command. The CLI, per-command, and global policy levels remain higher-precedence opt-outs — see the "Codex sandboxed-worktree git writes & network policy" section above. `timeout` bounds a headless subprocess (seconds). When **unset**, the review/deps services compute the budget with `effective_timeout` (`delegation_service.py`, #366): it scales from **payload bytes + reasoning effort** — `scaled_timeout` starts at a **600s floor** (`TIMEOUT_FLOOR`, covers CLI cold-start + a small high-effort run), adds ~0.0075 s/byte of prompt, multiplies high/xhigh/max effort by 1.5–1.75×, and clamps to a **1500s ceiling** (`TIMEOUT_CEILING`). A headless timeout is **not** discarded: `run` (`utils/process.py`) decodes and reattaches the partial stdout (bytes even under `text=True`), `_delegate_headless` returns it as `feedback` with `DelegationResult.timed_out=True`, and wade **retries once** at a longer budget (`extended_timeout`, 1.5×) — bounding the *sum* of both legs to `TOTAL_TIMEOUT_CAP` (`TIMEOUT_CEILING + TIMEOUT_CEILING * TIMEOUT_RETRY_MULTIPLIER`, ~3750s / 62.5 min) so the worst case is predictable while the retry always gets the full multiplier, never a shorter budget than the attempt that just timed out (#366 review). The pre-launch advisory — now also printed by `deps_service.analyze_deps` before a headless run, not just the review commands (#366 review) — announces that worst-case total. A crash (`CommandError` / non-zero exit) is never retried and never flagged `timed_out`. Setting `ai.<cmd>.timeout` **explicitly** is a deliberate override: it is honored verbatim and **bypasses scaling and the retry math** — the escape hatch for orchestrators with a hard tool-timeout (set it below the harness limit). The fallback chain (tool/model) is: CLI `--ai`/`--model` flag -> command-specific config -> global `default_tool`. This is implemented in `ProjectConfig.get_ai_tool(command)` and `ProjectConfig.get_model(command)`. When `mode` is omitted, `review_plan` and `review_implementation` default to `prompt`, while `review_batch` defaults to `interactive`. `review_pr_comments` (#389) governs the **auto-launched review session** (post-`done` "Wait for reviews" → comments land → `review_service.start`): it resolves that session's tool, model, effort, and autonomy tier under its own key rather than inheriting `ai.implement.*`. The inherited implementation-session `tool` / `model` / `permission_mode` are honored only when the user set them *explicitly* (`--ai` / `--model` / `--permission-mode` / `--yolo`); the implementation flow forwards its already-*resolved* concrete values (never `None`), which would otherwise short-circuit the resolvers and shadow `ai.review_pr_comments` — so a merely config/default-derived value is dropped and the review config (then global `ai.*`) governs.
 
 **Permission (autonomy) mode vs. delegation `mode` — two orthogonal axes**: The `mode` key (`DelegationMode`: `prompt`/`interactive`/`headless`, `models/delegation.py`) governs *how* a tool is dispatched. `permission_mode` (`PermissionMode`: `default`/`accept-edits`/`auto`/`yolo`, `models/permission.py`) governs *how much* the tool may do without prompting — the autonomy axis crossby exposes via the `yolo`/`auto`/`accept_edits` launch booleans. Do **not** conflate them: they live in separate modules on purpose. Resolution (`resolve_permission_mode()` in `ai_resolution.py`) follows CLI `--permission-mode` > `--yolo` alias > command config > global config > `default`; `permission_mode` wins over the legacy `yolo` alias at any level, and `get_yolo()`/`resolve_yolo()` are thin shims that derive from the resolved mode so the alias has a single source of truth. WADE forwards only the *requested* tier and does **not** gate on per-tool capability — crossby owns capability-aware downgrades and warnings (`_autonomy_launch_args`), so `auto` on a non-Claude tool downgrades to `accept-edits` instead of WADE silently disabling it. The headless delegation path always forces `default` (no autonomy grant) regardless of config, since `deps`/`review_plan`/`review_implementation`/`review_batch` are read/analytical; `review_pr_comments` is the exception — it launches an *interactive* session and honors its configured `ai.review_pr_comments.permission_mode`. `plan` is intentionally excluded from `PermissionMode` (WADE drives plan mode separately via `plan_service` → `plan_mode=True` for native plan tools, and `plan_mode=False` for Antigravity CLI whose native plan mode sandboxes writes to an external brain store while WADE's plan-artifact guard enforces containment); a configured or CLI-supplied `permission_mode: plan` (or any invalid value) warns and falls back to `default`. Every launch command (`plan`, `implement`, `implement-batch`, `review pr-comments`, `review plan`/`implementation`/`batch`, `task deps`, and the delegation paths) exposes `--yolo`/`--permission-mode` and resolves + forwards the tier; `confirm_ai_selection()` (`ai_resolution.py`) **always displays** the resolved tool/model/effort/permission mode with a per-tier descriptor (`permission.describe_permission_mode`) before its skip guard, so the mode surfaces on every path (TTY, non-TTY, headless, all-flags-explicit) and what is shown always equals what is applied. For the read-only headless paths (`deps`/`review_*` in headless mode), the service computes the *effective* mode as `default` and uses that single value for both display and the `DelegationRequest`, mirroring the `delegation_service` headless force-default rule. In addition, a completed non-zero headless exit preserves trimmed stdout and appends a clearly labeled stderr tail (the final 20 non-empty lines, capped at 4,000 characters, with truncation labeled); only failures with neither stream retain the generic no-output fallback.
 
@@ -1199,6 +1217,8 @@ When wade installs skills into a target project (per session, via worktree boots
 
 **`wade implement-batch`:**
 - `--model` — Pass a specific AI model to all parallel sessions.
+- `--network` / `--no-network` — Pin network access for every child session;
+  when omitted, each child resolves its normal implementation default.
 - `--skill` / `--review-skill` — Repeatable ordered bindings forwarded to every
   child implementation session.
 - `--refresh-skills` — Explicitly refresh frozen bindings in resumed child

{wade_cli-0.53.0 → wade_cli-0.54.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "wade-cli"
-version = "0.53.0"
+version = "0.54.0"
 description = "WADE — Workflow for AI-Driven Engineering"
 readme = "README.md"
 license = "MIT"

{wade_cli-0.53.0 → wade_cli-0.54.0}/src/wade/__init__.py

@@ -1,3 +1,3 @@
 """WADE (Workflow for AI-Driven Engineering) — AI-agent-driven git workflow management CLI."""
 
-__version__ = "0.53.0"
+__version__ = "0.54.0"

{wade_cli-0.53.0 → wade_cli-0.54.0}/src/wade/cli/main.py

@@ -217,13 +217,14 @@ _PERMISSION_MODE_OPT = typer.Option(
 # Shared tri-state flag for the Codex sandbox network policy. ``--network``
 # enables network access inside the sandbox (needed for git fetch/push, hence
 # the network legs of sync/done); ``--no-network`` forces it off; omitted (None)
-# defers to ``ai.network_access`` config, which itself defaults to disabled. Only
-# Codex acts on it — every other tool ignores it upstream.
+# defers to command/global config and then the command default. Interactive
+# implementation and PR-comment sessions default on; other commands default off.
+# Only Codex acts on it — every other tool ignores it upstream.
 _NETWORK_ACCESS_OPT = typer.Option(
     None,
     "--network/--no-network",
-    help="Allow network access inside the Codex sandbox (default: off; "
-    "required for git fetch/push under Codex). Overrides ai.network_access.",
+    help="Allow network access inside the Codex sandbox (default: on for implementation "
+    "and PR-comment sessions). Overrides ai.network_access.",
 )
 
 
@@ -411,6 +412,7 @@ def implement_batch_cmd(
     ),
     yolo: bool = typer.Option(False, "--yolo", help="Skip AI tool permission prompts."),
     permission_mode: str | None = _PERMISSION_MODE_OPT,
+    network_access: bool | None = _NETWORK_ACCESS_OPT,
     skill: list[str] | None = typer.Option(  # noqa: B008
         None, "--skill", help="WORK methodology skill ref forwarded to every child session."
     ),
@@ -458,6 +460,7 @@ def implement_batch_cmd(
         effort_explicit=effort is not None,
         yolo=yolo or None,
         permission_mode=permission_mode,
+        network_access=network_access,
         work_skills=skill,
         review_skills=review_skill,
         refresh_skills=refresh_skills,

{wade_cli-0.53.0 → wade_cli-0.54.0}/src/wade/cli/review.py

@@ -198,8 +198,8 @@ def review_pr_comments_cmd(
     network_access: bool | None = typer.Option(
         None,
         "--network/--no-network",
-        help="Allow network access inside the Codex sandbox (default: off; "
-        "required for git fetch/push under Codex). Overrides ai.network_access.",
+        help="Allow network access inside the Codex sandbox (default: on for PR-comment "
+        "sessions). Overrides ai.network_access.",
     ),
     skill: list[str] | None = typer.Option(  # noqa: B008
         None, "--skill", help="WORK methodology skill ref. Repeat for an ordered binding."

{wade_cli-0.53.0 → wade_cli-0.54.0}/src/wade/models/config.py

@@ -115,6 +115,15 @@ AI_COMMAND_NAMES: tuple[str, ...] = tuple(command.value for command in AICommand
 """Canonical per-command AI config sections supported by WADE."""
 
 
+NETWORK_ENABLED_BY_DEFAULT_COMMANDS: frozenset[str] = frozenset(
+    {
+        AICommandKey.IMPLEMENT,
+        AICommandKey.REVIEW_PR_COMMENTS,
+    }
+)
+"""Interactive Codex session commands whose required lifecycle needs network access."""
+
+
 LEGACY_AI_COMMAND_ALIASES: dict[str, str] = {"work": "implement"}
 """Back-compat aliases accepted in config validation/loading paths."""
 
@@ -127,11 +136,11 @@ class AIConfig(BaseModel):
     effort: str | None = None
     permission_mode: str | None = None
     yolo: bool | None = None
-    # Global Codex sandbox network policy (default disabled). ``None`` here is
-    # the unset state that :meth:`ProjectConfig.get_network_access` resolves to
-    # ``False`` — network is off unless a project opts in. Wade always passes an
-    # explicit pin at launch so ambient Codex ``config.toml`` can never silently
-    # enable network for a wade-managed sandbox.
+    # Global Codex sandbox network policy. ``None`` defers to the command's
+    # built-in default: enabled for interactive implementation and PR-comment
+    # sessions, disabled for every other command. Wade always passes an explicit
+    # pin at launch so ambient Codex ``config.toml`` can never silently change
+    # a wade-managed sandbox.
     network_access: bool | None = None
     plan: AICommandConfig = AICommandConfig()
     deps: AICommandConfig = AICommandConfig()
@@ -598,15 +607,19 @@ class ProjectConfig(BaseModel):
         """Resolve the Codex sandbox network policy for a command.
 
         Fallback: command-specific ``ai.<command>.network_access`` → global
-        ``ai.network_access`` → ``False``. Network is **disabled by default**;
-        an explicit ``True`` at either level opts in. Only Codex honors this
-        (crossby capability-gates every other tool), and wade always forwards
-        the resolved bool so ambient Codex config can never silently flip it on.
+        ``ai.network_access`` → command default. Interactive implementation and
+        PR-comment sessions default to enabled because their required lifecycle
+        reaches GitHub; all other commands are always disabled. Only Codex
+        honors this (crossby capability-gates every other tool), and wade always
+        forwards the resolved bool so ambient Codex config can never silently
+        flip it on.
         """
+        if command and command not in NETWORK_ENABLED_BY_DEFAULT_COMMANDS:
+            return False
         if command:
             cmd_config = getattr(self.ai, command, None)
             if isinstance(cmd_config, AICommandConfig) and cmd_config.network_access is not None:
                 return cmd_config.network_access
         if self.ai.network_access is not None:
             return self.ai.network_access
-        return False
+        return command in NETWORK_ENABLED_BY_DEFAULT_COMMANDS

{wade_cli-0.53.0 → wade_cli-0.54.0}/src/wade/services/ai_resolution.py

@@ -22,7 +22,7 @@ import structlog
 from crossby.ai_tools import AbstractAITool
 from crossby.models.ai import AIToolID, EffortLevel
 
-from wade.models.config import AICommandConfig, ProjectConfig
+from wade.models.config import NETWORK_ENABLED_BY_DEFAULT_COMMANDS, AICommandConfig, ProjectConfig
 from wade.models.delegation import DelegationMode
 from wade.models.permission import (
     PermissionMode,
@@ -206,7 +206,7 @@ def resolve_permission_mode(
 ) -> PermissionMode:
     """Resolve the autonomy tier from args -> config -> ``default``.
 
-    Fallback chain (highest precedence first):
+    The fallback chain (highest precedence first) is:
       1. Explicit ``--permission-mode`` CLI value
       2. ``--yolo`` CLI alias (equivalent to ``permission_mode=yolo``)
       3. Command/global config (``ai.<command>.permission_mode`` / ``yolo``,
@@ -246,21 +246,24 @@ def resolve_network_access(
     config: ProjectConfig,
     command: str = "plan",
 ) -> bool:
-    """Resolve the Codex sandbox network policy from args -> config -> ``False``.
+    """Resolve the Codex sandbox network policy from args -> config -> command default.
 
     Fallback chain (highest precedence first):
       1. Explicit ``--network`` / ``--no-network`` CLI value
       2. Command-specific config (``ai.<command>.network_access``)
       3. Global config (``ai.network_access``)
-      4. ``False`` (network **disabled by default**)
-
-    Network is off unless the project (or CLI) opts in — this is a deliberate
-    safety default: wade forwards the resolved bool as an explicit pin so an
-    ambient Codex ``config.toml`` can never silently enable network access for a
-    wade-managed sandbox. Non-Codex tools ignore the value (crossby
-    capability-gates it via ``supports_network_access``), so this resolves for
-    every tool but only Codex acts on it.
+      4. Command default: enabled for ``implement`` and ``review_pr_comments``;
+         disabled for all other commands.
+
+    Wade forwards the resolved bool as an explicit pin so an ambient Codex
+    ``config.toml`` can never silently change network access for a wade-managed
+    sandbox. Non-Codex tools ignore the value (crossby capability-gates it via
+    ``supports_network_access``), so this resolves for every tool but only Codex
+    acts on it. Non-interactive commands remain disabled even when the project
+    config enables network globally.
     """
+    if command not in NETWORK_ENABLED_BY_DEFAULT_COMMANDS:
+        return False
     if network_access is not None:
         return network_access
     return config.get_network_access(command)

{wade_cli-0.53.0 → wade_cli-0.54.0}/src/wade/services/implementation_service/core.py

@@ -434,6 +434,7 @@ def start(
     work_skills: list[str] | None = None,
     review_skills: list[str] | None = None,
     refresh_skills: bool = False,
+    plan_handoff: bool = False,
 ) -> ImplementResult:
     """Start an implementation session on an issue.
 
@@ -453,6 +454,10 @@ def start(
         project_root: Repository root (defaults to CWD).
         detach: If True, launch AI in a new terminal tab.
         cd_only: If True, create worktree and print path only (no AI launch).
+        plan_handoff: Internal marker for an accepted ``wade plan`` handoff.
+            A network-enabled Codex implementation must launch in a fresh
+            detached context rather than inherit the planner's network-off
+            sandbox.
 
     Returns:
         ImplementResult with success/merged status.
@@ -639,9 +644,10 @@ def start(
             permission_mode, yolo, config, "implement"
         )
 
-        # Resolve the Codex sandbox network policy (default disabled). Always
-        # passed explicitly at launch so ambient Codex config can never silently
-        # enable network for this wade-managed sandbox; only Codex acts on it.
+        # Resolve the Codex sandbox network policy (enabled by default for this
+        # interactive lifecycle). Always passed explicitly at launch so ambient
+        # Codex config can never silently change this wade-managed sandbox; only
+        # Codex acts on it.
         resolved_network_access = resolve_network_access(network_access, config, "implement")
 
         # When resuming, override the resolved tool and skip interactive confirmation
@@ -931,9 +937,19 @@ def start(
             return ImplementResult(success=True)
 
         # AI-initiated start guard: if we're inside an AI CLI session,
-        # don't launch another AI tool — just print the worktree path.
+        # don't launch another AI tool — just print the worktree path.  The
+        # one exception is a plan handoff from Codex to a network-enabled Codex
+        # implementation: network is a launch-time sandbox property, and the
+        # planner always ran with it disabled, so that handoff needs a fresh
+        # detached process instead of reusing this agent context.
         detected_env = _detect_ai_cli_env()
-        if detected_env:
+        requires_fresh_codex_handoff = (
+            plan_handoff
+            and detected_env == "CODEX_CLI"
+            and resolved_tool == AIToolID.CODEX.value
+            and resolved_network_access
+        )
+        if detected_env and not requires_fresh_codex_handoff:
             logger.info(
                 "implementation.ai_launch_skipped",
                 reason="inside_ai_cli",
@@ -960,8 +976,10 @@ def start(
         except OSError:
             logger.warning("implementation.transcript_dir_failed")
 
-        # Detach mode: launch AI tool in a new terminal, don't block
-        if detach and resolved_tool:
+        # Detach mode: launch AI tool in a new terminal, don't block.  A
+        # network-enabled Codex plan handoff is forced through this path so it
+        # cannot inherit the planner's immutable network-off sandbox.
+        if (detach or requires_fresh_codex_handoff) and resolved_tool:
             cmd: list[str] | None = None
             try:
                 detach_adapter = AbstractAITool.get(AIToolID(resolved_tool))
@@ -995,18 +1013,40 @@ def start(
                         effort=resolved_effort,
                         allowed_commands=config.permissions.allowed_commands,
                         working_dir=worktree_path,
-                        network_access=resolved_network_access,
+                        # ``requires_fresh_codex_handoff`` already established
+                        # the resolved value is true; pin it explicitly for the
+                        # new Codex process rather than relying on ambient config.
+                        network_access=(
+                            True if requires_fresh_codex_handoff else resolved_network_access
+                        ),
                         **permission_mode_launch_kwargs(resolved_permission_mode),
                     )
             except (ValueError, KeyError):
-                cmd = [resolved_tool]
-
-            console.step(f"Launching {resolved_tool} in new terminal...")
-            assert cmd is not None  # guaranteed by the two branches above
-            if launch_in_new_terminal(cmd, cwd=str(worktree_path), title=work_title):
-                console.success(f"Detached AI session for #{task.id}")
+                # A fresh Codex handoff must retain its explicit sandbox,
+                # network, permission, and prompt arguments.  Do not replace a
+                # failed build with bare ``codex``, which would bypass them.
+                if not requires_fresh_codex_handoff:
+                    cmd = [resolved_tool]
+
+            if cmd is not None:
+                console.step(f"Launching {resolved_tool} in new terminal...")
+                if launch_in_new_terminal(
+                    cmd,
+                    cwd=str(worktree_path),
+                    title=work_title,
+                    wait_for_ready=requires_fresh_codex_handoff,
+                ):
+                    console.success(f"Detached AI session for #{task.id}")
+                    stop_title_keeper()
+                    return ImplementResult(success=True)
+            if requires_fresh_codex_handoff:
+                console.error(
+                    "Could not launch a fresh Codex implementation session with network access."
+                )
+                console.hint("Open a new host terminal, then run:")
+                console.detail(f"wade implement {task.id} --network")
                 stop_title_keeper()
-                return ImplementResult(success=True)
+                return ImplementResult(success=False)
             console.warn("Could not launch in new terminal — falling back to inline")
             detach = False
             # Fall through to inline launch below

{wade_cli-0.53.0 → wade_cli-0.54.0}/src/wade/services/plan_service.py

@@ -1539,7 +1539,10 @@ def _offer_to_implement(
         return False
 
     try:
-        result = start_implementation_session(target=issue_number)
+        # Planning always launches with network disabled.  Tell implementation
+        # startup this is an accepted handoff so it can establish a fresh Codex
+        # context when its independently resolved policy needs network access.
+        result = start_implementation_session(target=issue_number, plan_handoff=True)
         return result.success
     except Exception:
         logger.exception("plan.work_session_start_failed", issue=issue_number)

{wade_cli-0.53.0 → wade_cli-0.54.0}/src/wade/services/review_service.py

@@ -1173,8 +1173,9 @@ def start(
     resolved_permission_mode = resolve_permission_mode(
         effective_pm, yolo, config, "review_pr_comments"
     )
-    # Codex sandbox network policy (default disabled); always pinned explicitly
-    # at launch so ambient Codex config can never silently enable it.
+    # Codex sandbox network policy (enabled by default for this interactive
+    # lifecycle); always pinned explicitly so ambient Codex config cannot
+    # silently change it.
     resolved_network_access = resolve_network_access(network_access, config, "review_pr_comments")
 
     if not detach: