Skip to content

feat(codex): native agents overview and standalone runtime (v0.94.0) - #492

Merged
ralyodio merged 1 commit into
mainfrom
feat/codex-agents-overview
Sep 6, 2026
Merged

feat(codex): native agents overview and standalone runtime (v0.94.0)#492
ralyodio merged 1 commit into
mainfrom
feat/codex-agents-overview

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

Routes CLI and TUI agents codex through the native shared-daemon overview, with the approval/sandbox bypass correctly placed before the agents subcommand. Uses the official managed standalone installer on macOS/Linux because the npm-only CLI cannot bootstrap the local daemon; preserves Windows npm/remote support. Adds launch and installer regression tests, refreshes help/docs, and bumps moshcode to 0.94.0. Verified native Codex 0.151.0 argument parsing; full Node test suite run locally. Does not change global Codex permission settings or stop existing sessions.

Comment thread test/engines.test.mjs
test("Codex overview keeps the root bypass before agents and preserves native view options", async () => {
const nativeBin = tempDir();
writeEngine(nativeBin, "codex");
const extra = ["--no-alt-screen", "-C", "/tmp/project with spaces", "-c", 'model="gpt-6-astra"'];
@github-actions

github-actions Bot commented Sep 6, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

4 finding(s) in the 6 file(s) this pull request changes.

MEDIUM: 4

Severity Rule Location
MEDIUM sql-string-concatenation src/cli-schema.mjs:163
MEDIUM sql-string-concatenation src/cli-schema.mjs:535
MEDIUM sql-string-concatenation src/cli-schema.mjs:661
MEDIUM insecure-temp-file test/engines.test.mjs:154
88 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 70 | **LOW**: 10

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:202
HIGH sh-remote-script-execution install.sh:213
HIGH sh-remote-script-execution install.sh:219
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:974
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1044

…and 68 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 4d645fe into main Sep 6, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants