Codex, phases 8 to 10b and the 10b review: Bibo's codex.rs, the repair asks Codex, steps, diagnosis and guard per agent, the screens, all hidden while Codex is closed

[undistracted2cha]

Phases 8 to 10b of the Codex plan (docs/proposals/codex.md, §2.4, §4 and §6): Bibo's phases, all on this branch. Codex stays closed on every system: in production an agents.json that lists Codex is not trusted, so the repair (phase 9) asks no one and the screens (10b) do not show it, and Bibo without Codex behaves exactly as on master.

app/src-tauri/src/codex.rs

The Rust copy of the kit's launcher without tools (engine/hooks/_headless_codex.py), for Bibo:

• Finding Codex (find): the official installer's place first (~/.local/bin/codex, %LOCALAPPDATA%\Programs\OpenAI\Codex\bin\codex.exe), then the PATH and Homebrew's folders; on Windows an .exe only (npm's codex.cmd goes through cmd.exe).
• The ChatGPT login, without a billed key (login, §4.3): chatgpt, billed, managed, logged_out or unknown. auth.json is read for its mode, its plan and whether a refresh token is there, nothing else. Then codex login status, run as a question would run it (same allow-list environment, same -c), is compared to fixed lines and never copied: its stderr shows part of an API key. No key ever reaches Codex; Bibo never logs anyone out.
• The contract without tools (check, ask): the launcher's checks before a question, in its order (Windows %ProgramData%\OpenAI\Codex, version and exec --help, .env, managed layers, auth.json and plan, login status, features list with the user's and an empty CODEX_HOME, MCP servers), the same -c, the same refusals and pauses (kind, reason and words), the same private folder, the same reading of the stream, the prompt on stdin only, --ephemeral. « Arrêter » is honoured between the probes and before the question.
• sys::run_isolated_pipes: each line with its pipe (Codex says its login on stderr), and once Codex exits, what it left in its group is killed, as the launcher does on macOS and Linux. run_isolated (Claude's repair) is unchanged.

Where the two differ, the app is stricter (said at the top of codex.rs): a stream line that opens an object and is not JSON ends the run (Python reads NaN), an id_token with a character outside base64url is unreadable, a profile that is not a regular file counts as unreadable.

Parity: one test that fails when the two diverge

engine/tests/codex_contract.py describes the scenarios (114 on macOS, 109 on Linux and Windows): a home, a CODEX_HOME, managed layers, an environment and fake_codex.py's settings each. The Rust test the_app_and_the_launcher_answer_alike plays each one twice, in a world of its own, through codex.rs and through _headless_codex.py, and compares:

• the answer or the refusal, with its words;
• everything the fake Codex was given: each probe and the call, argv and -c in order, environment, folder, stdin, schema;
• the work folder empty afterwards, what Codex started gone;
• no token or key in what either side writes.

Scenarios include the order of the checks (two faults at once: the first check says why) and, on Windows, a %ProgramData%\OpenAI\Codex that appears after the probes. A second test compares the decision on Windows access lists (47,580 cases, on all three systems) and SIDs. Without Python both fail: no skip.

Found: codex-features.json was installed nowhere

The installed launcher (~/.claude/hooks/brain/_headless_codex.py) looks for codex-features.json next to itself: neither installer put it there, so Codex would have stayed paused for everyone once opened. Tests and codex-mock ran the launcher from the repository, where the file is one folder up. install.sh and install.ps1 now place it in their Codex section only (Claude alone: nothing changes); Bibo reads it at the same place. test-hooks.sh §16 and the windows job check the installed file and that the installed launcher reads it.

Not hollow

27 protections taken out one at a time, 25 in codex.rs and sys.rs and 2 in the launcher (a -c, the order of the checks, features list with an empty CODEX_HOME, auth.json, a caller's key passed on, a billed login line, login status's line copied, a tool item taken as an answer, --ephemeral, the group sweep, the cage left behind, the login shown, access lists, SIDs, the strict schema, the prompt as an argument, the MCP re-read, the removed stage, the minimum version, the repr of the words, the .env "CA" rule, the Team plan, an unreadable profile, an MCP server named in a comment; in the launcher notify=[] and the login status line). Each turns at least one test red; two did not at first and got their scenario (a .env setting LOCALAPPDATA, a profile that is a folder). Without install.sh's new line, test-hooks.sh is 220/221.

Checked locally (macOS)

cargo test (169), cargo clippy --all-targets -D warnings for macOS and for the Windows target (compile only, resource compiler stubbed), rustfmt on codex.rs only (the repository's style; sys.rs's deviations are master's), Python unit tests (649; the launcher's and the contract also under Python 3.9.6), test-hooks.sh 221/221, shellcheck, actionlint, bash -n, py_compile, node --check. No pwsh on this machine: install.ps1's line and the windows job are checked in CI only.

CI

• Tests: https://github.com/BrainInBox/brain-in-a-box/actions/runs/38979511517 (758042d), every job green. The parity runs in the app job on all three systems (Windows: 109 scenarios, about 60 s, including the icacls ones and the folder that appears after the probes).
• terrain.yml started by hand on the branch: https://github.com/BrainInBox/brain-in-a-box/actions/runs/38978042544 (8ab25a7, the same app), every job green, terrain_app on macOS, Windows and Linux included (Bibo, Claude alone, clicked through in its real window).
• The first test run (https://github.com/BrainInBox/brain-in-a-box/actions/runs/38977973724) failed on the windows job only, a defect of the bench: the new check imported the installed launcher and Python wrote its __pycache__ next to the hooks, which the step compares before and after ("Claude's install changed"). Fixed with python -I -B (in test-hooks.sh too).

---

Phase 9: the repair with Codex

Bibo's repair asks Codex when agents.json lists it (docs/proposals/codex.md, §2.4, §4.4; section « Étape 9 — fait et écarts »). Codex stays closed on every system: in production an agents.json that lists Codex is not trusted (ferme), and the repair then asks no one.

• The choice, read by the kit (agents.rs): _agents.py lire (new subcommand, one ASCII JSON line of what lire() says), run with the kit's Python, the installed copy next to the hooks first, else the one of the sources Bibo installed. The gate and the file's checks stay in _agents.py. Without the file: Claude alone, and nothing is run to know it. A file the kit cannot trust, or one Bibo cannot have read (no Python, no _agents.py): no AI is asked (new state agents).
• The same question: the same dossier on stdin (what « Voir exactement ce que j'envoie » shows), the same instructions, the same schema of the same closed lists, effort medium then high, the same validate(). Codex through codex.rs (ask_heard: told when the question leaves, and each stream line, kept masked in codex-stream.jsonl). Catalogue unchanged.
• The fallback is the kit's (_headless.py): the preferred engine, then the other one only when listed, after start, unsupported, auth, quota, api; after a timeout only towards Claude; never after init, invalid or « Arrêter ». An engine found unavailable before (not logged in, paused, offline) is never run. When none answers, the first one run says why; the others go to the journal (echecs) and the report.
• Claude in Terminal (plan B) stays Claude's, and only when Claude is listed: terminal_fallback, the last screen's button, and open_terminal refuses otherwise.
• The screens: the repair texts come from a name (ai()); Rust names the engine (engine in the status and the plan, stages asking_codex / asking_claude) only when Codex is listed. Codex's ChatGPT login button is phase 10b.

Claude alone, exactly as master

• Without agents.json nothing is run to read it; the status, the plan and the asking stage are master's JSON (no engine); the journal entry has master's keys, one by one; the report names no engine; every earlier repair.rs test passes unchanged.
• The screens: master's app.js with master's mock, and the branch's with the branch's, run in a small DOM under Node on 29 Claude-alone repair scenarios (Mac, Windows, Linux words; fixed, user action, low confidence, two rounds, failed down to Terminal, regression, quota, re-login, suspect, offline, Terminal, login put off, each error, each state, « Arrêter »): every screen has the same text, order and buttons. Control: one word changed in a note makes them differ. (No browser: Playwright is phase 10b's.)

Not hollow

33 protections taken out one at a time (the fallback rule, Terminal only when Claude is chosen, what the window is offered, Codex's refusals and what counts, the same schema, instructions and effort, the names in the journal and report, agents.rs's reading): each turns at least one test red. One did not at first (a reader that fails) and got its test.

Checked locally (macOS)

cargo test (187), cargo clippy --all-targets -D warnings for macOS and the Windows target (compile only), rustfmt in the repository's style on agents.rs and codex.rs (repair.rs: nothing beyond master's deviations), Python unit tests, test-hooks.sh 221/221, actionlint, node --check, py_compile.

CI

• Tests: https://github.com/BrainInBox/brain-in-a-box/actions/runs/39001033126 (399bfa0), every job green; the phase's tests run in the app job on all three systems (Windows: 11, without the 6 that need a fake claude).
• terrain.yml started by hand on the branch: https://github.com/BrainInBox/brain-in-a-box/actions/runs/39000240637 (ddd1852), every job green, terrain_app on macOS, Windows and Linux included (Claude alone, in the real window).
• The first test run (https://github.com/BrainInBox/brain-in-a-box/actions/runs/39000223598) found two Windows-only test defects, fixed in 399bfa0 (a relative codex_home dropped instead of refused; the fake Codex rewrote its instructions with CRLF), and saw codex-mock (macOS) go red once on the sign of life's known race (session-logger overwritten by a hook of the same event, three sessions in a row); green on the next run, unchanged.

---

Phase 10a: Bibo's brain, steps, diagnosis and configuration guard per agent

Bibo's back end follows the agents agents.json lists, read through _agents.py lire (phase 9) (docs/proposals/codex.md, §4.2, §4.5; section « Étape 10a — fait et écarts »). Codex stays closed on every system: in production an agents.json that lists Codex is not trusted, and nothing below shows for Claude alone.

• The brain's state per agent (detect.rs): the vault and the memory, then each listed agent's part. Claude's as before (hooks in settings.json, skills). Codex's: the kit's hook in its hooks.json, the kit's block in the instructions Codex reads (AGENTS.override.md when it has text, else AGENTS.md), the skills in ~/.agents/skills. Complete for each agent listed; the brain step runs again when a chosen agent is not wired. A choice the kit cannot trust is never complete.
• The Codex step (steps.rs): where Claude Code's stands, the preferred one first (steps::order). It runs the official installer of the rust-v0.162.1 release, checked against the SHA-256 install.sh and install.ps1 pin (a test holds the three equal), as they run it: CODEX_RELEASE, CODEX_NON_INTERACTIVE=1, the CODEX_HOME of agents.json, no VOYAGE_API_KEY nor the installer's own settings, Windows' tar first on the PATH. A Codex already there is kept; an older one is said, not replaced (as install.sh). A script that is not the pinned one never runs. The app job runs the step for real on each system (codex_real).
• The diagnosis per agent (diagnose.rs): Codex (version), its login (codex::login: ChatGPT account ok; an API key "would be billed: I don't use it"; a workspace account or imposed settings; not logged in), its hooks (and whether Codex runs them: new _agents.py hooks-muets, Bibo works nothing out itself), instructions and skills; each agent's site in the network check (claude.ai, chatgpt.com). Codex alone runs nothing of Claude's. An untrusted agents.json gives a red « Ton choix d'IA » line, and the brain step stops before downloading anything (the installers would stop anyway).
• The configuration guard (config_guard.rs): ~/.codex always (a Codex of the user's own, Claude alone included) and the CODEX_HOME of agents.json, wherever it is. hooks.json as settings.json; config.toml: only [hooks.state."<key>"] tables added at its end, one hash each, each naming one of the kit's hooks in that folder's hooks.json (group without a matcher, every command the same kit hook), and in a table of the kit's its hash and comment (another Python); nothing else (no setting, no approval of the user's hook or another hooks.json's, no hash slipped into the user's last table). AGENTS.md appended to; rules and ~/.agents/skills as hooks and skills. Checked against the installers' own wire.py: nothing to put back.
• remedies.rs: .codex and .agents in the catalogue test's NEVER list.

Claude alone, exactly as master

• Tests: every check word for word (network text, the brain's ids and order, missing parts and their order), the steps' order, nothing run without agents.json.
• Local comparison, master (e6b8be0) and the branch, --diagnose in four homes (empty, Claude's brain, agents.json ["claude"], a Codex of the user's own without a choice): identical JSON (free space aside). The only difference, by design: an agents.json listing Codex (closed) gives the red « Ton choix d'IA » line.
• The guard: the real install.sh, Claude alone, next to a ~/.codex of the user's: untouched.

Not hollow

41 protections taken out one at a time: 40 turn at least one test red. Seven did not at first and got their test (approval keys of the tests named another folder's hooks.json; a hash appended right after the file's end read as a change in place; the guard's own record already made the kit's skill "ours"; completeness ignored the instructions). The 41st, .codex/.agents in NEVER, only guards against a future remedy.

Checked locally (macOS)

cargo test (205; the real Codex install, ignored, runs in CI), cargo clippy --all-targets -D warnings for macOS and the Windows target (compile only), rustfmt in the repository's style on the phase's lines only, Python unit tests (651; _agents.py's also under Python 3.9.6), test-hooks.sh 221/221, actionlint.

CI

• Tests: https://github.com/BrainInBox/brain-in-a-box/actions/runs/39020021535 (ca095a0), all 13 jobs green; the real Codex step (codex_real, app job) installs Codex 0.162.1 through its pinned installer on macOS, Linux and Windows.
• terrain.yml started by hand on the branch: https://github.com/BrainInBox/brain-in-a-box/actions/runs/39018558300 (f5fb0d9), every job green, terrain_app on macOS, Windows and Linux included (Claude alone, in the real window); 568c32b and ca095a0 change tests only.
• The two runs before (https://github.com/BrainInBox/brain-in-a-box/actions/runs/39018551219, https://github.com/BrainInBox/brain-in-a-box/actions/runs/39019288099) found three Windows-only test defects, nothing to fix in the kit or the app: two guard tests named files with /; hooks-muets's print() ends with CRLF on Windows (the app trims it); the real test gave the official installer a \\?\ CODEX_HOME, which its Join-Path refuses (agents.json records a plain path).

---

Phase 10b: Bibo's screens for Codex (the choice, Codex's step, its ChatGPT login, the onboarding), hidden while the gate is closed

docs/proposals/codex.md, §4.1, §4.3, §4.4; section « Étape 10b — fait et écarts ». Codex stays closed on every system: as shipped the app asks nothing and every screen is master's.

• The gate, read in the kit (agents::codex_open): the CODEX_OUVERT line of the _agents.py that reads agents.json (installed, else the sources'), else, before any kit is on disk, the app's own copy of that file (include_str!). Read without Python (a fresh Mac or PC has none): only the line as the kit writes it; anything else is closed. A test plays every form against _agents.py ouvert. release.yml, test.yml's app job and the terrain's preview freshness follow _agents.py: the PR that opens a system publishes an app that offers it.
• The choice (§4.1), before the diagnosis, whose checks and steps follow it: the welcome names no AI and leads to « Avec quelle IA veux-tu travailler ? » (Claude, Codex, both; for both, who writes the evening summary, said both ways). Rust holds it for the session (choose_agents, agents::current); the brain step hands it to install.sh / install.ps1 (BIAB_AGENTS, BIAB_PREFERE), which alone write agents.json. Preselection: the choice made, else Claude alone on an install of before the choice, else what is installed.
• Codex's ChatGPT login (§4.3): codex -c cli_auth_credentials_store="file" login in Terminal / PowerShell, without OPENAI_API_KEY, CODEX_API_KEY, CODEX_ACCESS_TOKEN, OPENAI_BASE_URL; the window polls codex::login, never Codex's output. An API key or a workspace account is said and not used; Bibo never logs anyone out; « Plus tard ». The repair gets the same button.
• Onboarding and the assistant's name (§4.4): the preferred agent, opened in the vault (codex "<prompt>"); ONBOARDING.md speaks to Claude Code or Codex; the end names the agents chosen.
• Mock app/dev/mock.html: &porte=1, &choix=, &resume=, &codex=billed|managed|unknown; checked on screen with Playwright (Mac, Windows, Linux words).
• terrain_app, path app-codex on the three systems (terrain.yml matrix): the robot opens Codex in its own copy of the kit (the tested sources, gate open, as the other benches do), handed to the app and put in ~/.brain-in-a-box/src before its first start; it clicks « Choisir mon IA », « Codex », skips the Voyage key and the ChatGPT login. Codex's step must be seen, Claude's never; then terrain.check_codex: agents.json, codex --version, the six hooks with --agent codex approved, the kit's correction-detector run as Codex runs it, Codex's AGENTS.md and the vault's, the skills in ~/.agents/skills, nothing of Claude Code's.

Claude alone, exactly as master

• Closed as shipped: nothing is offered or looked for (offer), choose refuses Codex, no choice is pending, the installer gets what it got; 10a's tests of the diagnosis, steps and guard pass unchanged.
• Screens: master's app.js with master's mock and the branch's with the branch's, in a small DOM under Node, on 41 Claude-alone scenarios (fresh install on Mac, Windows, Linux, Voyage key, already installed, keywords, blocked, early login, failures, and phase 9's 29 repair scenarios): 39 give the same screens in the same order; the 2 clock-driven loops give the same screens in an order that varies from run to run, on master too. The only difference: the welcome comes after the gate is read, with the same words. Control: one word changed makes them differ.
• terrain_app's path app (Claude alone, real window) is unchanged, except that a Codex screen there now fails.

Not hollow

33 protections taken out one at a time (17 in the app, 16 in the robot): 32 turn at least one test red; five of the robot's did not at first and got their test; the 33rd (an unreadable _agents.py read as empty text) is equivalent: no gate line, closed.

Checked locally (macOS)

cargo test (211, 5 ignored), cargo clippy --all-targets -D warnings for macOS and the Windows target, rustfmt on the phase's lines, Python unit tests (661), test-hooks.sh 221/221, actionlint, the mock on screen (Playwright).

CI

• Tests: https://github.com/BrainInBox/brain-in-a-box/actions/runs/39037548671 (900fd32), all 13 jobs green (app and codex-mock on the three systems, app-windows-install, the bundles).
• terrain.yml started by hand on the branch: https://github.com/BrainInBox/brain-in-a-box/actions/runs/39036793212 (d4a9b61), every job green, including the six app legs in the real window: app (Claude alone) and app-codex (Codex chosen alone) on macOS, Windows and Linux. 900fd32 only adds tests.
• The first runs (tests https://github.com/BrainInBox/brain-in-a-box/actions/runs/39025784259, terrain https://github.com/BrainInBox/brain-in-a-box/actions/runs/39025792396, 74dd810) found three Windows-only defects of the benches, nothing in the app or the kit: the Rust test of Codex's folder read Windows' Python output (console code page) as UTF-8 (now -X utf8); test_terrain_app's fake Mac, run on the Windows runner, looked for Codex under LOCALAPPDATA (now the pilot says where); the Windows app-codex leg asked Claude Code which Git Bash it takes, with no Claude Code there, after every screen had passed (Claude Code's Git Bash check now runs on the path of Claude alone only).

Phase 10b review: fourteen findings, twelve fixed

docs/proposals/codex.md, section « Étape 10b — relecture et corrections ». Every fix has a test that was red before it. Codex stays closed; with Claude alone every screen is master's, now held in CI word for word.

Security

• Codex's onboarding on an API key (findings 1 and 9): Codex preferred and logged in with a key (or not at all), « Plus tard » at the ChatGPT screen, then « Personnaliser mon cerveau » ran a 15-minute codex session billed on the key in auth.json. Now start_onboarding asks codex::login and opens nothing but on a personal ChatGPT login, with -c cli_auth_credentials_store="file"; the end offers « Connecter Codex à mon compte ChatGPT » instead, with a note per state.
• CODEX_HOME from the shell profile (2): the login and onboarding windows unset it when agents.json records ~/.codex.
• A stream line with no end (3): sys::pump reads at most the cap of a line and drops the rest, as the launcher's _pump (Codex only; Claude's repair unchanged).
• The current folder on Windows (4, before this PR): find_codex (launcher) and codex::which (app) look in absolute PATH folders only. _headless_claude.find_claude has the same flaw on master: left to a PR of its own (Claude's path).

Non-regression

• agents.json ["claude"] with no kit on disk or no Python (5): the app runs its own copy of _agents.py; with no Python at all, Claude alone where the gate keeps Codex closed (master's behaviour).
• The guard for Claude alone (6): ~/.codex and ~/.agents/skills are guarded only when Codex is listed; master never looked there.
• Claude-alone screens in CI (7): app/dev/screens.mjs runs app.js and the mock in a small DOM on a clock of its own (deterministic), 43 scenarios compared screen by screen with app/dev/screens-claude.txt, written from master's app.js and mock (e6b8be0); run by the app job. Plus terrain_app: « pour Claude » in the welcome, « Claude retient » at the end.
• Plan figures (8): corrected in both copies.

Codex's screens (gate open in the mock): a workspace account or Windows' system settings end the login's wait and say why (codex::Login::System split from Managed); not_yet in the repair before the brain step; « Changer d'IA » on the diagnosis and the accounts' screens; one account rule (« un abonnement ChatGPT personnel (pas un compte d'entreprise) », « Il te faut les deux comptes »); the API key's screen asks for the button, no command. Nine mock scenarios check them in the same script; terrain_app's app-codex expects the ChatGPT login at the end, never the onboarding.

Checked locally (macOS): cargo test (217 + 1, 5 ignored), clippy for macOS and the Windows target, rustfmt on the lines touched, Python tests (664, 7 skipped; test_headless_codex under 3.9.6 too), test-hooks.sh 221/221, actionlint, node app/dev/screens.mjs, the new screens on Playwright.

CI: tests https://github.com/BrainInBox/brain-in-a-box/actions/runs/39044551159 (087405d), all 13 jobs green (parity on the three systems, the screens' check in the app job, app-windows-install, codex-mock). terrain.yml by hand on the branch: https://github.com/BrainInBox/brain-in-a-box/actions/runs/39043712047 (d373d3e, the same app), all green, including app and app-codex on macOS, Windows and Linux. The run before (https://github.com/BrainInBox/brain-in-a-box/actions/runs/39043712739) failed on Windows' app job only: a Windows-only test still expected the prompt right after codex.exe, before the store's -c (fixed in 087405d, nothing in the app).