ForgeGuard v1.5.0 — Codex Subagent Runtime

ForgeGuard v1.5.0 — Codex Subagent Runtime

ForgeGuard v1.5.0 adds optional Codex runtime defaults for authorized subagents while preserving the existing manual approval gate.

Default preset

[agents]
enabled = true
default_subagent_model = "gpt-5.6-luna"
default_subagent_reasoning_effort = "xhigh"

Enable it explicitly:

forgeguard install --client codex --subagents

A normal ForgeGuard install does not change Codex runtime defaults.

Delegation model

Subagent authorization is permission, not a requirement. If the user explicitly allows subagents, the primary agent may delegate bounded work when useful, but remains responsible for planning, integration, conflict resolution, final verification, and the final response.

A runtime preset never bypasses the explicit approval policy.

Safe config management

ForgeGuard manages only a marked block inside .codex/config.toml or the global $CODEX_HOME/config.toml.

It preserves unrelated settings and custom [agents.<role>] tables. Existing unmanaged subagent model or reasoning defaults are never overwritten automatically. An existing unmanaged enabled = false is treated as a conflict.

forgeguard uninstall removes only the ForgeGuard-managed runtime block. Use --no-subagent-config when the runtime block should be kept.

CLI additions

--subagents
--subagent-model <model>
--subagent-reasoning <effort>
--no-subagent-config

The default preset is equivalent to:

forgeguard install \
  --client codex \
  --subagent-model gpt-5.6-luna \
  --subagent-reasoning xhigh

Verification

The release adds Node built-in tests for runtime config creation, preservation, conflict detection, idempotency, status reporting, and uninstall cleanup. CI runs the unit suite on Node 18, 20, and 22 and exercises the Luna/xhigh CLI integration.