codex-plugin-cc v1.4.3

Internal restructure with no behaviour change: one home per duplicated helper, a shared test harness, tests/runtime.test.mjs split by command family, and two new guard tests.

Highlights

• plugins/codex/scripts: duplicated helpers consolidated (nowIso, readStoredJob, readJsonOrNull, shorten, looksLikeVerificationCommand, the pending-cancel text, the env-based session filter, buildJsonRpcError); the queued/running status comparisons go through lib/job-status.mjs; dead fs.mjs exports and unused symbols removed (eslint no-unused-vars is now on).
• Tests: shared harness helpers in tests/helpers.mjs; tests/runtime.test.mjs split into seven runtime-*.test.mjs files (same 143 tests), which roughly halves the local suite's wall time; new job-status and module-boundaries unit tests (leaf modules, hook allow-lists, the single job-control → codex edge); render helpers and the session filter gain direct tests.

Compatibility

• No CLI, hook, record or state-format change. Nothing for callers to do.

Validation

• Exact tag target: 9d2d4ac2a5ded3c3468da5cb7202e872093a458c
• Local gate: 475 tests (464 pass, 11 skipped), 0 leaked test processes, npm run build, npm run check-version, claude plugin validate . --strict
• GitHub CI: run on 9d2d4ac — https://github.com/CBEPX/codex-plugin-cc/actions/runs/36674667612 (10/10 jobs green)
• Review: Claude (Fable) per-stage and whole-branch reviews — approved with nits, applied; pr-review-toolkit code-reviewer and test analyzer, ponytail over-engineering review — applied; Codex review (default model) — no actionable regression; no adversarial pass (no behaviour change)
• Runtime dependency audit: npm audit --omit=dev reports 0 vulnerabilities

Artifact

• cbepx-codex-plugin-cc-1.4.3.tgz + SHA256SUMS

codex-plugin-cc v1.4.2

A brokered cancel now confirms the turn, not just the worker; a direct close reports whether the app-server exit was observed; two Windows SessionEnd and pid-sidecar gaps closed.

Highlights

• /codex:cancel on a job that runs through the shared broker sends turn/interrupt, then waits up to 10 s for the worker's own final record and only then records cancelled. If the turn does not end, it answers cancellationPending with reason: "turn-not-interrupted" (exit 1), kills nothing and leaves the job running (re-run the cancel or wait for the turn). A job that owns its app-server (transport: direct, e.g. a cold --resume-last) is stopped by stopping its worker, without a turn interrupt (turnInterruptAttempted: false). The direct path is taken only when the job file and the state index agree.
• Job records carry transport (broker / direct, set when the turn starts) and, on the worker's own final record, appServerExited (whether the direct app-server child's exit was observed before the 5 s close deadline). On Windows a vanished-root cancel is recorded cancelled only with workerClosed and an observed exit.
• Windows SessionEnd keeps a job whose kill was refused (identity-unavailable) or threw (kill-failed) even when its worker already exited (kept=true), the same rule the broker teardown uses.
• A worker's pid sidecar is written only while its job is queued or running, under the state lock; job-file reads retry EPERM/EBUSY on Windows.

Compatibility

• New job record fields in status --json / result --json: transport, appServerExited.
• New /codex:cancel pending reason turn-not-interrupted; a brokered cancel can take up to ~10 s longer.
• Known limitations (spec §Limits, CHANGELOG): a brokered turn that never ends keeps the job running until it ends or the broker is shut down; jobs started before 1.4.2 have no transport and are treated as brokered; on Windows the observed direct child is the codex.cmd shim's cmd.exe.

Validation

• Exact tag target: 5e45e86f1fd541ab6183f5f40392453dd807973c
• Local gate: 466 tests (455 pass, 11 skipped), 0 leaked test processes, npm run build, npm run check-version, claude plugin validate . --strict
• GitHub CI: run on 5e45e86 — https://github.com/CBEPX/codex-plugin-cc/actions/runs/36635024275 (10/10 jobs green); previous SHA 9f8058c run 36631219293: 10/10 jobs green
• Review: Codex adversarial review — pass 1 found one blocking-class item (fixed in 9f8058c), pass 2 SHIP; Claude (Fable) review per task and whole-branch — approved with nits, applied
• Runtime dependency audit: npm audit --omit=dev reports 0 vulnerabilities

Artifact

• cbepx-codex-plugin-cc-1.4.2.tgz + SHA256SUMS

codex-plugin-cc v1.4.1

Windows kills from stored process records now verify the process and terminate its tree; the broker gains a start/replace state machine; a transport bug with U+2028/U+2029 is fixed.

Highlights

• Windows: /codex:cancel, SessionEnd cleanup, stale-broker replacement and broker teardown verify the recorded pid by its start time and terminate the verified tree children-first through one in-box Windows PowerShell 5.1 run with pinned handles (no taskkill, no Store pwsh). A pid that is gone is reported as process-missing; orphans found are reported as survivors with cancellationPending, never marked cancelled.
• Broker lifecycle: a broker writes its record under the state lock before it spawns (starting → ready, replacing on a stale replacement); two racing starts settle inside the lock; a start that fails is torn down through the same verified kill; SessionEnd keeps records whose kill outcome is unknown (kept=true).
• Cancel: the worker's cooperative final record carries workerClosed: true; a vanished worker on Windows is recorded cancelled only on that record and an empty orphan walk. A failure the reaper recorded is always kept; any other record after the cancel's acknowledged interrupt or delivered kill becomes cancelled, as in v1.4.0.
• Transport: notifications containing U+2028/U+2029 no longer break the app-server connection (frames are split on \n only).
• CI: the "No leaked test processes" step is enforced on every OS; PowerShell launches pass LOCALAPPDATA/PSModuleAnalysisCachePath through, avoiding 20–30 s cold starts.

Compatibility

• New job record field job.workerClosed (boolean) in status --json / result --json.
• On Windows, /codex:cancel may answer cancellationPending with survivors (pid + identity) or identity-unavailable (broker still starting, Constrained Language Mode); SessionEnd teardown lines gain kept=.
• Known limitations (planned for v1.4.2): a brokered cancel confirms the worker, not the turn; workerClosed proves the client closed, not that every descendant exited (see README «Windows»).

Validation

• Exact tag target: 1f2d7ac915220f4fa7cc789444584db75626f79f
• Local gate: 453 tests (442 pass, 11 skipped), 0 leaked test processes, npm run build, npm run check-version, claude plugin validate . --strict
• GitHub CI: run on 1f2d7ac — https://github.com/CBEPX/codex-plugin-cc/actions/runs/36560045125 (10/10 jobs green); previous SHA f0945b1 run 36558470385: 10/10 jobs green
• Review: Codex adversarial review — 13 passes, converged to pre-existing scope items parked per the documented limits; Claude review — APPROVED WITH NITS, applied
• Runtime dependency audit: npm audit --omit=dev reports 0 vulnerabilities

Artifact

• cbepx-codex-plugin-cc-1.4.1.tgz + SHA256SUMS (same layout as v1.4.0)

v1.4.0

codex-plugin-cc v1.4.0

Engineering maturity plus Windows without $SHELL; the Windows CI matrix is now required.

Fixed

• Windows: commands are no longer spawned through $SHELL (usually Git Bash under Claude Code, which mangled taskkill /PID /T /F and other arguments); executables are resolved with where.exe, .exe/.com files run directly, and .cmd/.bat shims (including a global npm install -g @openai/codex) run through cmd.exe with every argument escaped for both cmd /c and the shim's own %* re-parse (%VAR:a=b% substitution is the one documented ceiling; an argument containing CR/LF is refused) (openai#525, openai#647, openai#656, openai#669, openai#708, openai#287, openai#409, openai#735).
• Windows: the broker and app-server child processes no longer flash a visible console window on spawn (windowsHide: true) (openai#440, openai#451).
• The Stop, SessionStart and SessionEnd hooks read stdin with a bounded deadline (2 s / 5 s / 1 s respectively) and a 1 MiB limit instead of a blocking readFileSync(0); a disabled Stop review gate no longer hangs until the 900 s hook timeout when stdin never arrives, and the companion no longer crashes with EAGAIN reading a non-blocking stdin under concurrent sessions (openai#530, openai#544, openai#120, openai#247, openai#123, openai#150, openai#165).
• --args-stdin (and $ARGUMENTS) no longer eats a backslash that does not escape a quote, another backslash or whitespace, so Windows paths such as C:\Users\me\project\file.mjs survive; \\server\share is a documented limitation, and --prompt-stdin remains available for byte-exact text.
• Windows: state.json reads and writes and lock-ticket reads retry briefly (bounded, roughly 300 ms worst case) on EPERM/EBUSY/EACCES instead of failing outright when another process holds the file open.

Added

• SECURITY.md (supported versions, GitHub Security Advisories reporting) (openai#326).
• Node 24 development tooling: ESLint, a typecheck:tests script over tests/** and scripts/** (checkJs is off for now — turning it on surfaced 54 pre-existing findings, deferred), c8 coverage (npm run test:coverage, thresholds in .c8rc.json), Stryker mutation testing over the critical args.mjs/model-catalog.mjs pair (npm run test:mutation:critical), a check:changelog gate that keeps CHANGELOG.md and plugins/codex/CHANGELOG.md byte-identical, Dependabot, and npm run setup:git-hooks (pre-commit lint + typecheck).
• CI: one workflow run per SHA (push limited to main, release branches checked via manual workflow_dispatch, with a concurrency group cancelling superseded runs) and a new quality job on Node 24 alongside the existing OS × Node matrix.

Changed

• The per-user fallback state root used when CLAUDE_PLUGIN_DATA is unset is now %LOCALAPPDATA%\codex-companion on Windows. A pre-1.4.0 root under %TEMP%\codex-companion-user keeps being used, with a one-line stderr notice, until it is removed by hand — nothing is migrated automatically. This transitional notice only applies to an unversioned/dev checkout: a marketplace install's state-root hash is derived from CLAUDE_PLUGIN_ROOT, which already includes the plugin version in the marketplace cache, so a normal upgrade never sees the legacy root.
• BROKER_BUSY_RETRY_MS widened from 1000 to 3000 ms; the "teardown only after the broker confirmed idle" invariant is unchanged.
• Deferred v1.3.0 review minors folded in: CODEX_REVIEW_GATE_MAX_ROUNDS rejects a non-integer, negative or otherwise malformed value (falls back to 3 with a warning) instead of misreading it; setup --review-gate-model "" / --review-gate-effort "" now fails with --<flag> needs a value; use inherit to clear it. instead of writing anything; a job id used to build the workerCommandLine match is now regex-escaped; the kill-failed broker-teardown reason is documented in the README's reason table. Also added (test coverage only, no behavior change): a catalogue-only model alias resolving correctly on a priority tie, and the fallback-root refusal covering a non-standard directory mode.

Known limitations

• Kills issued from stored process records (/codex:cancel, SessionEnd cleanup, stale-broker replacement, broker teardown) are still refused on Windows (identity-unavailable); process identity verification is now targeted for v1.4.1, not v1.4.0 as previously stated. /codex:cancel still sends the turn interrupt on a best-effort basis; SessionEnd only refuses. A worker or broker left behind exits when its turn ends and, for the broker, once every client has disconnected and its idle timeout elapses — an unbounded turn is not reaped on Windows until v1.4.1.

Ported with reference to upstream PRs by mohammad-malik, mittalpk, stantheman0128, tmchow, D2758695161, ikbear, e345ee, tanakauo.

Install

claude plugin marketplace add CBEPX/codex-plugin-cc
claude plugin install codex@cbepx

The attached cbepx-codex-plugin-cc-1.4.0.tgz is the npm pack output; its SHA-256 is in SHA256SUMS.

• Exact tag target: 6f0467f06feaf8e83162c671af910c4073083016
• Local gate: 360 tests / 359 pass / 1 win32-only skip, 0 leaked test processes, npm run check (lint, typecheck, coverage thresholds, changelog gate), claude plugin validate . --strict, npm audit --omit=dev 0 vulnerabilities
• CI: run 36389450461 on 5b6bb46 — ubuntu/macos/windows × node 18/22/24 + quality all green (Windows required)
• Codex adversarial review: 8 passes at --effort max; pass 8 = SHIP

codex-plugin-cc v1.3.0

Lifecycle correctness: turns that no longer hang, kills that only ever hit the process they were meant for, and a stop gate you can pin.

Highlights

• Terminal error notifications end the turn as failed instead of hanging; retried errors keep it running; a subagent's error no longer fails the main turn (openai#698, openai#757, openai#775, openai#781).
• Broker lifecycle: bounded connects with ETIMEDOUT fallback, wedged-broker replacement with a 2 s readiness retry, no signal to a stale or recycled pid, freshly spawned brokers that never become ready are killed as a process group (openai#753, openai#762, openai#768, openai#749, openai#773, openai#782).
• Identity-checked kills and reaping on posix (openai#743): pidIdentity in job records, JSON pid sidecars (legacy integer still read) and broker.json; cancel keeps a job running and says so when the kill could not be confirmed; SessionEnd keeps records of workers it did not stop.
• status <id> --wait exits 1 and prints a timeout line when the wait times out (openai#774).
• Stop gate: setup --review-gate-model <model|inherit> --review-gate-effort <effort|inherit>, default of 3 gate-induced rounds (CODEX_REVIEW_GATE_MAX_ROUNDS=0 restores unbounded), signal name and /codex:setup --disable-review-gate hint in every infrastructure failure reason, hooks.json without a top-level description (openai#769, openai#548, openai#589, openai#483, openai#459).
• Transfer honours CLAUDE_CONFIG_DIR (openai#721).
• Model aliases resolve against the local Codex catalogue ($CODEX_HOME/models_cache.json, then codex debug models --bundled), astra alias, effort validated per model (openai#468, openai#703, openai#485).
• Security: fallback state root is per-user (0700) and per-plugin, symlinked roots refused; broker.json validated before use (openai#521, openai#609).

Compatibility

• status --wait now exits 1 on timeout (also with --json; the snapshot keeps waitTimedOut).
• CODEX_REVIEW_GATE_MAX_ROUNDS unset now means 3 rounds (was unbounded).
• Pid sidecars jobs/<id>.pid are JSON; v1.2.x integer sidecars and records without pidIdentity still work on posix.
• Windows: kills from stored records (cancel worker, SessionEnd cleanup, stale-broker replacement, broker teardown) are refused until process identity lands in v1.4.0; leaks are bounded by the broker idle timeout and the turn interrupt is still sent.
• Fallback state under os.tmpdir() (only when CLAUDE_PLUGIN_DATA is unset) is keyed by plugin install path and is not carried over across plugin updates.

Validation

• Exact tag target: 78576a5d376524d347e79a46fea7543332f7da3b
• Local gate: 313/313 tests, 0 leaked test processes, npm run build, npm run check-version, claude plugin validate . --strict
• GitHub CI: https://github.com/CBEPX/codex-plugin-cc/actions/runs/36351327223
• Review: Codex adversarial review (five passes, final verdict: ship), Claude whole-branch review (with fixes, all addressed)
• Runtime dependency audit: npm audit --omit=dev reports 0 vulnerabilities

Artifact

78e98e2296c9ab2d2cded2798e86f518e5dea7c9252a48641a87d738921f9550 cbepx-codex-plugin-cc-1.3.0.tgz

codex-plugin-cc v1.2.0

Synchronous rescue, bounded turns, and a state layer that survives concurrent sessions and killed workers.

Highlights

• task --await [--await-timeout-ms], --prompt-stdin, and result <id> [--wait --timeout-ms]: /codex:rescue and the rescue agent are a single node … task --await --prompt-stdin <<'CODEX_PROMPT_…' call again, allowed-tools is back to Bash(node:*), and exit codes are documented (0 done, 1 failed, 3 still running with a printed Re-run: line).
• Session lifecycle: SessionEnd stops only its own foreground jobs, checks for any active job in the workspace, and asks the broker to shut down only when it is idle (newline-framed, id-matched, 5 s-bounded handshake; an unanswered handshake skips teardown). The broker refuses broker/shutdown while another client is connected, self-terminates on idle (openai#457), and its own shutdown is bounded so a peer that never answers the FIN cannot make it ignore SIGTERM.
• Bounded turns: --turn-timeout-ms / CODEX_TURN_TIMEOUT_MS interrupt the turn, wait for the terminal notification, and record a structured failed; the ack timer is referenced, a transport exit always yields a terminal record, and close() is idempotent and bounded (TERM → KILL).
• State integrity: a replace-free cross-process ticket lock (Lamport bakery on uniquely named immutable files under state.lock.d/; dead PID → taken over at once, unreadable holder → 2 s, unusable PID → 30 s, live PID → never; listing/stat/read errors fail closed; 5 s bound naming the blocking PID and entry), atomic state writes, a PID sidecar written after spawn, file-first reaper reconciliation, and dead workers reported as failed with their private payload removed.
• Secrets: every --config value is redacted in job records and every status/result rendering; the raw request lives only in a 0600 payload file; v1.1.1 records are migrated (queued jobs get their payload file before redaction).
• Releases now ship as GitHub Releases with the npm pack tarball and its SHA-256 attached; release-verify.yml re-runs the gate on the published tag (docs/RELEASING.md).

Compatibility

• /codex:rescue bodies changed shape (single companion call); custom wrappers that parsed the old status --wait loop should use task --await / result --wait.
• Job state directory gains state.lock.d/, jobs/<id>.pid and 0600 jobs/<id>.request.json; a legacy state.lock directory from unreleased builds is ignored.
• SessionEnd is more conservative: with CODEX_COMPANION_BROKER_IDLE_TIMEOUT_MS=0 a lingering client keeps the broker alive until the operator stops it.

Validation

• Exact tag target: 002a9b643eccd4f156175820037093de3d2f80e4 (merge of #3; branch head ae32d99)
• Local gate: 239/239 tests, 0 leaked test processes, npm run build, npm run check-version, claude plugin validate . --strict
• GitHub CI: release branch ae32d99 green on push, pull_request and a re-run (https://github.com/CBEPX/codex-plugin-cc/actions/runs/33175542754, https://github.com/CBEPX/codex-plugin-cc/actions/runs/33175546290); main after merge: https://github.com/CBEPX/codex-plugin-cc/actions/runs/33176478976 (green)
• Review: Codex adversarial review ×16 (final verdict approve) and Claude (opus) review ×13 (final verdict SHIP) over 17 fix waves; every finding either fixed on the branch or recorded for 1.2.1
• Runtime dependency audit: npm audit --omit=dev reports 0 vulnerabilities
• Live verification against Codex CLI 0.150.1: --turn-timeout-ms → structured failed; SIGKILLed background worker → failed, payload removed; task --await round trip; /codex:status and /codex:rescue synchronous in Claude Code 2.1.247 auto mode

Artifact

a77beb45af79a481c8c6ae7d0e57f035e6e5a6ea3d0b65c0581248727870b6d0 cbepx-codex-plugin-cc-1.2.0.tgz

codex-plugin-cc v1.1.1

Lifecycle hardening release: idle brokers stop accumulating.

Fixed

• Broker idle self-terminate (upstream openai#457): the shared Codex runtime exits after 30 minutes without a connected client (CODEX_COMPANION_BROKER_IDLE_TIMEOUT_MS / --idle-timeout; exactly 0 disables), so idle brokers and their app-server children no longer accumulate (openai#543).
• Broker lifecycle races found while merging openai#457: a broker that self-terminates drops its broker.json ownership record; SessionEnd teardown verifies the recorded PID really is this session's broker before signalling it; the broker stops listening before it closes its app-server child, so a client connecting mid-shutdown is refused instead of failing its first RPC.
• The test suite no longer leaks fake codex app-server/broker processes (5 s idle timeout in the test environment; CI fails if any codex-plugin-test-* process survives).
• Rescue shell blocks use command rm -f -- in their cleanup trap (no noise from rm aliases such as trash).

Validation

• Exact tag target: 6672679a39e564506654c825d3fea7ea5758eebc (merge of #2)
• GitHub CI: 150/150 tests, no leaked test processes, build green — https://github.com/CBEPX/codex-plugin-cc/actions/runs/33123122013
• Review: Codex adversarial review (two lifecycle races found and fixed before tag) + Claude (opus) review
• Live check (Claude Code 2.1.247, auto mode): /codex:status and /codex:rescue --model sol --effort max run without permission prompts; rescue returns synchronously

Artifact

c5f0a4c2e5413e43bbca15a15d7c82294c746308b57e74274ea1be54a4908a0f cbepx-codex-plugin-cc-1.1.1.tgz

codex-plugin-cc v1.1.0

First release of the CBEPX fork of openai/codex-plugin-cc (1.0.6, db52e28). Marketplace cbepx, plugin name unchanged (codex), so /codex:* commands and codex:codex-rescue keep working.

Highlights

• Upstream pull requests merged: openai#616 (max/ultra effort), openai#688 (model aliases on review), openai#426 (on-request approval for --write), openai#501 (MCP elicitations), openai#608 (rescue agent awaits the result), openai#690 (explicit Bash blocks in command bodies), openai#547 (--help, unknown flags are errors), openai#645/openai#644 (job records store resolved model/effort/sandbox), openai#672/openai#668/openai#682/openai#396 (hook timeouts, idempotent env exports, fail-closed stop gate, CODEX_REVIEW_GATE_MAX_ROUNDS).
• Slash-command arguments reach the companion through a quoted heredoc on stdin (--args-stdin) — $(...)/backticks in a prompt no longer execute on the host shell; /codex:rescue carries the prompt through --prompt-file byte-exact.
• Approval requests are answered with each type's refusal variant instead of a -32601 protocol error; all MCP elicitations are declined.
• Background job records are written before the worker spawns; the worker reads its full request (including --config values) from a private 0600 jobs/<id>.request.json; status/result keep secret-looking config values redacted.
• Per-thread model/effort via thread/start.config (model, review_model, model_reasoning_effort); repeatable --config key=value on task/review/adversarial-review; --effort works on reviews; aliases sol, luna, terra, mini, spark.
• --resume-last is a cold resume (fresh app-server session) that never sends model on thread/resume; a resume refuses a thread still used by a queued/running job.
• /codex:rescue is synchronous by default (task --background → status --wait slices → result) and asks before continuing an existing thread.
• Hermetic test environment (tests/test-env.mjs), CI on push, npm run build type-checks the JSDoc.

Validation

• Exact tag target: 23942d75f5a8364f10ac817b2b351d70b25e99c4 (merge of #1)
• GitHub CI: 142/142 tests, build green — https://github.com/CBEPX/codex-plugin-cc/actions/runs/33090291002
• Review: Codex adversarial review + Claude (opus) review of the release branch; final wave applied (--args-stdin heredocs, approval denials, elicitation declines, record-before-spawn, --config redaction, busy-thread guard)
• Live verification against Codex CLI 0.150.1: task --model sol --effort max, cold --resume-last --effort max, metacharacter prompts echoed byte-exact with nothing executed on the host, native review --model sol --effort xhigh, --write escalation denied without hanging

Artifact

05afa4e2dc409fbe6552022f031aa0addcf01a124dafc00915bdb11c1589b6d6 cbepx-codex-plugin-cc-1.1.0.tgz