codex-in-claude v0.14.0

A discovery-slimming and sync-timeout release. The tools/list catalog gets lighter and a new
codex://params resource becomes the single home for the full parameter contracts, the sync tools
steer long-running work to their _async variants at selection time, and the built-in sync
timeout_seconds default rises from 180 to 300. The agent-visible surface changed (result
fingerprint codex-in-claude/0.1/schema-46 → schema-49), so pre-1.0 this is
a minor release; clients that cache by fingerprint re-fetch the contract. Every change is
backward-compatible — no tool, field, or error code was removed or retyped.

Added

• codex://params resource and parameter-contracts capabilities fold-in (#333). A new
  read-only resource serves the full lifecycle/validation semantics for parameters whose
  tools/list description is a compressed summary, backed by a single-source
  PARAMETER_CONTRACTS registry so the inline summary and the resource body cannot drift.
  codex_capabilities(include_schemas=["parameter-contracts"]) embeds the same document for
  resource-blind clients. Its content is guarded by the new parameter_contracts
FINGERPRINT_COVERS category and the manifest snapshot.

Changed

• Slimmed the tools/list catalog (#333). MCP inlines each parameter description into every
  tool's schema, so a long shared description repeats on the wire. The idempotency_key and
  reasoning_effort inline descriptions are compressed to their selection-, safety-, and
  spend-critical facts (the full lifecycle/validation detail moves to codex://params),
  workspace_root/isolation are tightened, and the sync/async tool docstrings are slimmed —
  reducing the serialized tools catalog by ~6% (~85.2 KB → ~80.2 KB, snapshot measure) with
  no weakened guarantee: a table-driven per-tool freeze test asserts every egress/security
  guarantee (raw-input, files-read, auto-loaded AGENTS.md/.agents/skills, isolation, best-
  effort redaction, delegate no-network, review diff-redaction) still ships inline. This bumps the
  result fingerprint but is not breaking; the deeper ≤60 KB target requires opaquing the output
  schemas (tracked separately).

• Sync tools steer long-running work to their _async variants, and the default sync
  timeout_seconds rises from 180 to 300 (#338, #341). Two changes to how the synchronous tools
  handle work that can outlast a foreground call:

  • The codex_consult / codex_review_changes / codex_delegate descriptions, their _async
    counterparts, all six codex_capabilities use_when entries, and the server instructions
    block now name the shapes that can exceed the synchronous deadline — a high-reasoning-effort or
    broad repo-grounded consult, a multi-file or whole-branch review, or a substantial
    implementation task — and recommend the matching _async tool, so the steer reaches the agent
    at tool-selection time instead of only in the post-timeout repair, after the paid run was
    already lost.
  • The built-in default sync timeout_seconds rises from 180 to 300: a sync call that omits
    timeout_seconds now waits up to 300s before terminating. The 10–600s clamp and the
    CODEX_IN_CLAUDE_TIMEOUT_SECONDS operator override are unchanged, and a caller wanting the
    prior deadline can pass timeout_seconds=180. 300 is the smallest round value that recovers the
    mid-tier consult/review runs observed exceeding the old 180s cap; the destructive >~420s cliff
    stays the domain of the _async variants (separate 1800s job deadline), so the raise reduces
    the frequency of mid-tier sync timeouts rather than removing the cliff. A longer sync deadline
    only helps a client whose own foreground window is at least the server deadline; a client with a
    short window already backgrounds long sync calls, and the timeout_seconds/env override remains
    the escape hatch either way.

  The collaborating-with-codex skill routing and the /codex:consult|review|delegate command
  prompts carry the same steer. Wording and default-value changes that narrow no input and weaken no
  guarantee — the deadline was already documented as overridable — so they move the result
  fingerprint but are not breaking. A codex_dry_run size advisory remains tracked separately
  (#342).

• Internal: the stripped git-subprocess environment is now built by a single
  gitdiff._base_git_env() helper shared across _core (previously duplicated at five
  call sites), so the hardening posture cannot drift between them.

Fixed

• Untracked-file handling now honors the user's global gitignore (#330). The git
  subprocesses that enumerate untracked files run with a HOME-stripped environment
  (deliberate hardening — no user hooks/fsmonitor/attributes), which also prevented git
  from resolving the user's global excludes (core.excludesFile from global config,
  or the default ~/.config/git/ignore / $XDG_CONFIG_HOME/git/ignore). As a result a
  globally-ignored file (e.g. a ~/.config/git/ignore-listed .claude/settings.local.json)
  was misclassified as untracked: it inflated the untracked_files_detected /
  delegate-plan untracked counts, and under untracked="include" its contents were
  gathered and sent to OpenAI, contrary to the documented "non-ignored untracked files"
  contract. The effective core.excludesFile is now resolved from the server's own
  environment (mirroring git's own precedence, including a repo-local override) and passed
  explicitly as -c core.excludesFile=<path> to only the untracked-enumeration calls, so
  the global ignore layer is honored without restoring HOME (no other global config
  becomes readable). The resolver drops inherited GIT_DIR-family variables so a stray
  GIT_DIR cannot anchor resolution to another repo, and GIT_CONFIG (which only
  git config honors) so it mirrors what ls-files actually reads. Repo-local
  (.gitignore, .git/info/exclude) and local/system core.excludesFile layers with
  ordinary absolute or relative paths were already honored; a ~-containing local/system
  core.excludesFile previously failed to expand under the HOME-stripped child (a fatal
  error) and now resolves too, since the value is ~-expanded in the server. Behavior-only
  fix restoring the already-documented meaning — no change to the agent-visible schema or
  descriptions, so the result fingerprint is unchanged.