codex-in-claude v0.18.0

Added

• cli_contract.PONTONIER_CONTRACT — the declarative CLI contract in the shared
  BackendContract shape, derivation-pinned against the legacy constants.
• Surface-honesty gates via pontonier.testing: FORBIDDEN_SURFACE_PHRASES
  (cross-bridge contamination canaries and refused-mechanism claims) enforced
  against the built manifest.
• backend.CodexBackend — this bridge's adapter on the frozen pontonier
  AgentBackend protocol (contract_api_version = 1), validated by an argv
  differential against the production command builder.

Changed

• Every model-bearing run now goes through the pontonier AgentBackend adapter:
  codex.run_codex_exec stages via CodexBackend.prepare() (temp artifacts,
  argv from the shared builder, prompt over stdin, help-gate drops surfaced on
  PreparedRun.dropped_flags) and keeps only the execution step — timeouts,
  output byte caps, and event streaming stay this bridge's. The consult-only
  --skip-git-repo-check moved from an inline call-site flag to backend policy
  derived from the canonical kind, pinned by the argv differential test (which
  now compares against true production argv — it previously validated a variant
  without the flag). Wire snapshots are byte-identical; argv is unchanged for
  every tier.

• Generic core machinery (jobs, worktree, gitdiff, redaction, runtime,
  gitproc, streamcap, idempotency, workspace, jsoncache) now comes from
  the shared pontonier library
  instead of the vendored _core/ package. This bridge's worktree knobs
  (cic-worktree- prefix, codex-in-claude@local baseline identity) are pinned
  in config.WORKTREE_CONFIG, so git-visible behavior is unchanged; all wire
  snapshots are byte-identical.

• Docs and code comments retire the deleted _core/ package. CONTRIBUTING.md's one-way
  import rule named a directory that no longer exists, and SECURITY.md / COMPATIBILITY.md
  cited _core/redaction.py / _core/workspace.py as the authority for security-relevant
  behavior; all now point at pontonier.core. Eight source and test comments were updated the
  same way, and tests/test_backend.py no longer calls the protocol "provisional" while every
  other doc calls it frozen. No agent-visible surface changed — the built manifest is
  byte-identical, so no FINGERPRINT bump.

• Runtime dependency bumps. fastmcp 3.4.5 → 3.4.7. The built manifest is byte-identical
  under the new version, so the agent-visible surface is unmoved and no FINGERPRINT bump follows.

• Tracked Codex version is now 0.147. SUPPORTED_VERSIONS tracks (0, 147); a 0.146 CLI
  still runs and only draws the advisory codex_status warning. The docs/UPGRADING-CODEX.md
  procedure was run end to end against codex-cli 0.147.0, A/B'd against a side-by-side
  0.146.0 from npm (the retrieved binary authenticated clean against the committed 0.146.0
  help snapshots, and an npm-vs-Homebrew diff of the new version retired the cross-channel
  concern). Nothing this plugin sends or reads changed: all 11 ALWAYS_SEND_FLAGS, --model, and
  the three sandbox values are present, and the guarantee semantics were re-probed live —
  read-only blocked a write, workspace-write allowed the workspace write and blocked network
  egress, --output-last-message received the final message, and an --output-schema run
  validated against FINDINGS_OUTPUT_SCHEMA. The model_reasoning_effort config key is still
  applied (the backend rejection carried both [ReasoningEffortParam] and [reasoning.effort]),
  and codex exec still has no dedicated effort flag. Contract-drift stderr signatures still
  match. docs/codex-help/0.147.0/ carries fresh snapshots and the live integration suite
  passes against the new binary.

• KNOWN_MODEL_SLUGS gains gpt-5.6-sol-wm. The bundled advisory fallback is refreshed from
  the 0.147.0-written models_cache.json. The catalog is backend-served rather than shipped in
  the binary, so this slug had already appeared under 0.146.0 — it is catalog drift the upgrade's
  slug diff caught, not a 0.147 change. The reasoning-effort discovery fields still hold their
  pinned shape.

• --approve-for-me (new in 0.147.0) is deliberately not adopted, and cli_contract.py now
  records why alongside the other never-sent flags: it routes approval requests through an
  automatic review under the workspace-write sandbox, which would let a read-only-tier run
  acquire write capability without the caller electing a write tier.

• App-server: the 0.146.0 → 0.147.0 generated-schema diff is additive only on the consumed
  surface — an optional extensions map on InitializeParams (not sent), an optional title on
  the import progress/completed per-item results (read tolerantly, ignored), and two new
  PlanType values, self_serve_business_prolite and enterprise_cbp_automation, already read as
  a free-form capped string. Ten unconsumed v2 ThreadSection* messages were added; none removed.

Fixed

• Multi-line private-key blocks (PEM/PKCS8/OpenSSH/PGP) in gathered diffs and
  returned prose are now redacted statefully (via pontonier): the BEGIN/END
  markers stay visible, every body line between them is replaced with a
  [redacted: secret value] marker, and an unterminated block fails closed. Previously only the
  BEGIN marker was masked while the entire base64 body was sent.
• Bare provider tokens are now redacted. The shared redactor adds patterns for github_pat_,
  glpat-, sk-ant-, npm_, and pypi- tokens. The vendored redactor already caught these in a
  labelled assignment (token = "…"), because its value-pattern matcher keys on the label; what
  changed is the unlabelled case — a bare token in prose, or a diff line with no key = in front
  of it, which that redactor passed through verbatim. Measured old-vs-new over both spellings: five
  improvements, and no payload where the new redactor leaks something the old one caught.
• Redaction preserves the diff's trailing newline, so delegate diffs are
  git apply-able again (ports moonbridge's fix).
• COMPATIBILITY.md corrects the 2026-08-02 "parent AGENTS.md above the git root is loaded"
  observation. That mechanism does not reproduce on 0.146.0 or 0.147.0: the parent codeword
  was absent from both binaries with a project AGENTS.md present, with it removed, and with
  --cd set to a repository subdirectory. The corrected behavior is that codex walks upward from
  the resolved workspace directory and stops at the git root. What is retracted is the
  mechanism, not the concern — because resolve_workspace returns an explicit workspace_root
  unchanged, the resolved workspace can be a subdirectory, and the walk then crosses above it
  (from repo/sub, codex loaded repo/AGENTS.md). The published "the resolved workspace's
  AGENTS.md" caveat therefore still understates egress and issue #472's conclusion stands.
  Correcting that published wording is a FINGERPRINT-bumping change tracked in #472, so this
  entry changes no agent-visible text and carries no bump.
• config.py's extra-args comment no longer states a plugin-side narrowing as a codex fact.
  It claimed an attached -cKEY=VAL is "rejected"; codex accepts it (clap attached short-option
  value) on both 0.146.0 and 0.147.0. It is this parser that refuses it, because the
  attached-form split fires only on long --flag=value. Behavior is unchanged and
  safe-direction — the plugin passes through strictly less than codex would take.
• Shared-core diagnostics stay inside the server's log configuration. Moving the core out of
  codex_in_claude._core made its loggers siblings of the server namespace rather than children,
  so pontonier.core.* records inherited none of the configured handlers and propagated to the
  stdlib root logger instead — the exact escape propagate = False exists to prevent, since an
  embedding host may have wired root to stdout (the stdio JSON-RPC channel). obs.configure() now
  configures the pontonier namespace alongside codex_in_claude, so library diagnostics honor
  CODEX_IN_CLAUDE_LOG_LEVEL/CODEX_IN_CLAUDE_LOG_FILE and reach the same stderr and file
  handlers.