@@ -19,7 +19,7 @@ bun run test:skill-eval-cell -- \
 
 `--read-only` enforces the fake boundary, it does not merely suggest it: Codex drops `--dangerously-bypass-approvals-and-sandbox` and runs `--sandbox read-only` (the two contradict each other), and Claude pairs `--allowedTools Read,Glob,Grep` with a `--disallowedTools` list that also names `Task,Skill,WebFetch,WebSearch,NotebookEdit` — under `--dangerously-skip-permissions` those stay callable, so allow-listing alone leaves the boundary open.
 
-Prints a `summary.json` path. Each host gets its own workspace copy plus stdout/stderr, git status/log, and a file list. PATH shims live beside that workspace, never inside it, so the skill under test never sees harness files as its own dirty tree. Grade those; Grok narrates before the answer (grep `FILES_READ:`). Codex transcript is stderr, final message is stdout. `claude -p` is one-tick only.
+Prints a `summary.json` path. Each host gets its own workspace copy plus stdout/stderr, git status/log, and a file list. PATH shims live beside that workspace, never inside it, so the skill under test never sees harness files as its own dirty tree. Grade those; Grok narrates before the answer (grep `FILES_READ:`). Codex transcript is stderr, final message is stdout. A conversation cell (`--persona`) differs: Codex runs with `--json`, `stdout.txt` is the conversation with every agent message of each turn, and the event stream, tool calls included, lands in `stderr.txt`. `claude -p` is one-tick only.
 
 Each invocation requires a new or empty `--out` directory and records input and
 evidence fingerprints. Packs freeze their scenario criteria and grader hashes.
 
@@ -1,7 +1,7 @@
 import { describe, expect, test } from "bun:test"
-import { USER_DONE, hostTurnArgv, runUserSim, simReplyOrDone, toollessClaudeArgv, userSimPrompt } from "./converse"
+import { USER_DONE, codexAgentText, hostTurnArgv, runUserSim, simReplyOrDone, toollessClaudeArgv, userSimPrompt } from "./converse"
 
-const base = { sessionId: "11111111-1111-4111-8111-111111111111", message: "hi", cwd: "/w", lastMessageFile: "/h/last.txt" }
+const base = { sessionId: "11111111-1111-4111-8111-111111111111", message: "hi", cwd: "/w" }
 
 describe("hostTurnArgv", () => {
   test("claude pins the session on the first turn and resumes it after", () => {
@@ -19,7 +19,11 @@ describe("hostTurnArgv", () => {
     expect(first.at(-1)).toBe("hi")
     const next = hostTurnArgv("codex", { ...base, first: false })
     expect(next.slice(0, 4)).toEqual(["codex", "exec", "resume", "--last"])
-    expect(next).toContain(base.lastMessageFile)
+    // Every turn must emit events: the last-message outputs drop what Codex said before its closing line.
+    for (const argv of [first, next]) {
+      expect(argv).toContain("--json")
+      expect(argv).not.toContain("-o")
+    }
   })
 
   test("hosts without a scriptable resume are rejected", () => {
@@ -28,6 +32,23 @@ describe("hostTurnArgv", () => {
 })
 
 describe("conversation control", () => {
+  test("a codex turn records every agent message in order and nothing else", () => {
+    // Event shapes as emitted by codex-cli 0.160.0 `exec --json`.
+    const events = [
+      `{"type":"thread.started","thread_id":"t"}`,
+      `{"type":"turn.started"}`,
+      `{"type":"item.completed","item":{"id":"item_0","type":"reasoning","text":"thinking"}}`,
+      `{"type":"item.completed","item":{"id":"item_1","type":"agent_message","text":"| role | model |\\n| plan | opus |"}}`,
+      `{"type":"item.started","item":{"id":"item_2","type":"command_execution","command":"cat config.yaml","aggregated_output":"","exit_code":null,"status":"in_progress"}}`,
+      `{"type":"item.completed","item":{"id":"item_2","type":"command_execution","command":"cat config.yaml","aggregated_output":"secret: 1\\n","exit_code":0,"status":"completed"}}`,
+      `{"type":"item.completed","item":{"id":"item_3","type":"agent_message","text":"I'm waiting for your list of roles."}}`,
+      `{"type":"turn.completed","usage":{"input_tokens":1,"output_tokens":1}}`,
+      "",
+    ].join("\n")
+    expect(codexAgentText(events)).toBe("| role | model |\n| plan | opus |\n\nI'm waiting for your list of roles.")
+    expect(codexAgentText("warning: not an event\n")).toBe("")
+  })
+
   test("the simulated user can decline to reply", () => {
     expect(simReplyOrDone(`  ${USER_DONE}\n`)).toBeNull()
     expect(simReplyOrDone("")).toBeNull()
 
@@ -24,7 +24,7 @@ export function formatTranscript(turns: Turn[], userLabel: string): string {
 
 export function hostTurnArgv(
   host: Host,
-  opts: { first: boolean; sessionId: string; message: string; cwd: string; lastMessageFile: string },
+  opts: { first: boolean; sessionId: string; message: string; cwd: string },
 ): string[] {
   if (host === "claude") {
     // AskUserQuestion cannot reach a person in print mode; removing it makes the
@@ -36,7 +36,9 @@ export function hostTurnArgv(
     ]
   }
   if (host === "codex") {
-    const common = ["--dangerously-bypass-approvals-and-sandbox", "--skip-git-repo-check", "-o", opts.lastMessageFile]
+    // --json puts the turn's events on stdout so codexAgentText can keep every agent
+    // message; -o and plain stdout carry only the last one.
+    const common = ["--dangerously-bypass-approvals-and-sandbox", "--skip-git-repo-check", "--json"]
     // Resume without an id picks the newest session recorded for this cwd; every
     // host runs in its own workspace, so that is this conversation.
     return opts.first
@@ -46,6 +48,26 @@ export function hostTurnArgv(
   throw new Error(`--persona supports ${CONVERSE_HOSTS.join(", ")} only, not ${host}`)
 }
 
+/**
+ * What Codex said to the user in one `codex exec --json` turn: every agent message, in
+ * order. Codex spreads a reply over several messages and tends to end on a one-line
+ * prompt, so the last message alone drops most of it. Tool calls, command output, and
+ * reasoning are other item types and stay out.
+ */
+export function codexAgentText(events: string): string {
+  const messages: string[] = []
+  for (const line of events.split("\n")) {
+    let event
+    try {
+      event = JSON.parse(line)
+    } catch {
+      continue
+    }
+    if (event?.type === "item.completed" && event.item?.type === "agent_message") messages.push(event.item.text)
+  }
+  return messages.join("\n\n")
+}
+
 export function userSimPrompt(persona: string, turns: Turn[]): string {
   const transcript = formatTranscript(turns, "YOU")
   return [
 
@@ -11,7 +11,7 @@ import fs from "node:fs"
 import path from "node:path"
 import { arg, flag } from "./cli"
 import { REPO_ROOT, WORKTREE_REF, extractSkill, mintCellDir } from "./extract"
-import { CONVERSE_HOSTS, formatTranscript, hostTurnArgv, runUserSim, type ConversationEnd, type Turn } from "./converse"
+import { CONVERSE_HOSTS, codexAgentText, formatTranscript, hostTurnArgv, runUserSim, type ConversationEnd, type Turn } from "./converse"
 import { HOSTS, planHost, resolveRunHosts, wrapPrompt, type Host, type HostPlan } from "./hosts"
 import { installPathShims, type PathShim } from "./path-shim"
 import { fingerprint, prepareOutput, sealEvidence, sha256, writeJSON } from "./provenance"
@@ -157,7 +157,6 @@ async function converse(
   opts: { prompt: string; persona: string; timeoutMs: number; maxTurns: number },
 ): Promise<RunResult & { turns: number; ended: ConversationEnd; argvs: string[][] }> {
   const sessionId = crypto.randomUUID()
-  const lastMessageFile = path.join(hostDir, "last-message.txt")
   const deadline = Date.now() + opts.timeoutMs
   const turns: Turn[] = []
   const log = path.join(hostDir, "transcript.jsonl")
@@ -171,20 +170,14 @@ async function converse(
   for (let i = 0; i < opts.maxTurns; i++) {
     const remaining = deadline - Date.now()
     if (remaining <= 0) { ended = "timeout"; last.timedOut = true; break }
-    fs.rmSync(lastMessageFile, { force: true })
-    const argv = hostTurnArgv(host, { first: i === 0, sessionId, message, cwd, lastMessageFile })
+    const argv = hostTurnArgv(host, { first: i === 0, sessionId, message, cwd })
     argvs.push(argv)
     last = await runPlan({ ...plan, argv }, cwd, remaining)
     stderr += last.stderr
-    let agentText = last.stdout
-    if (host === "codex") {
-      try {
-        agentText = fs.readFileSync(lastMessageFile, "utf8")
-      } catch {
-        // codex wrote no final message; keep its stdout
-      }
-    }
-    agentText = agentText.trim()
+    // Codex's stdout is its event stream here; the tool calls it holds stay in the
+    // cell's stderr.txt, out of the graded transcript.
+    if (host === "codex") stderr += last.stdout
+    const agentText = (host === "codex" ? codexAgentText(last.stdout) : last.stdout).trim()
     turns.push({ role: "agent", text: agentText })
     fs.appendFileSync(log, `${JSON.stringify({ role: "agent", text: agentText, exitCode: last.exitCode })}\n`)
     if (last.timedOut) { ended = "timeout"; break }