v0.2.0-rc.4

[0.2.0-rc.4] - 2026-08-04

Added

• Run repository-controlled content in an OS command sandbox: verification
  commands, the external secret scanner, and Git hooks execute through
  SandboxedCommandRunner (bubblewrap on Linux, seatbelt on macOS) with
  network disabled, the filesystem read-only outside the worktree, and
  credential stores (~/.ssh, ~/.aws, ~/.config, ...) hidden; posture
  fails closed when the sandbox is unavailable.
• Replace full host-environment inheritance with an explicit allowlist: the
  Reasonix ACP child gets a system baseline (PATH, HOME, CODEX_HOME, locale,
  temp, XDG_*, CA variables) plus REASONIX_* pass-through; anything else —
  provider credentials included — is forwarded only through
  CODEX_REASONIX_ENV_ALLOWLIST (comma-separated picomatch globs), and the
  hard-deny list (NODE_OPTIONS, LD_PRELOAD, ...) wins over the allowlist.
• Bind finalize approval to the exact reviewed snapshot: control input now
  requires expected_review_revision and expected_review_tree_hash,
  validated at finalize_start, after_verification, and before_staging
  so an approval captured before a repair that re-captured the tree is
  rejected with the fresh snapshot in the error details; taskView and
  reasonix_delegate output carry review_tree_hash.
• Make pause acknowledgment token-bound: a monotonic pauseRevision plus
  pauseReasonHash (sha256 of the canonical pause reason) are stored in task
  state and bumped through a single enterPaused() helper.
• Persist task state with crash-consistent journal transactions: each append
  is a bounded pending transaction (atomic-write pending-event envelope,
  append + fsync events.jsonl, atomic-write + fsync state.json, remove
  envelope + fsync directory), and startup recovery reconciles interrupted
  transactions from the journal/state combination.
• Own the atomic commit exactly: createAtomicCommit takes the task's
  expectedBranch and requires an exact symbolic-ref HEAD match (prefix
  siblings are rejected before any ref or index write), uses the same exact
  ref for the forward update-ref CAS and the rollback CAS, and assertStagedChecks
  runs with --no-ext-diff so configured textconv/external diff drivers can
  never execute during bridge checks.
• Add an end-to-end security proof matrix (tests/e2e/security-matrix.test.ts)
  covering credential reads, network egress, out-of-worktree writes, Git
  hooks, and environment exfiltration rows against the integrated hardening.
• Extend doctor with a real command-sandbox availability probe and report
  the effective posture (run_git_hooks, allow_unsandboxed, env allowlist
  size) in its JSON report.
• Rewrite docs/security.md around the hardened model — sandboxing and trust
  boundaries, environment allowlist, approval and pause binding, journal
  durability, exact Git ownership, and a threat-model table mapping every
  matrix row to its gates and tests — and add a security-posture section to
  the README.

Fixed

• Resume legacy pauses (recorded before pause tokens existed, pauseRevision 0) directly instead of requiring inspectedAfterPause, which production
  code no longer sets — such tasks previously could never resume.
• Deny hardlink creation (file-link) in the seatbelt profile so credential
  files cannot be hardlinked into the writable worktree; keep /dev/null
  writable for git, extend the credential overlay list
  (.kube, .docker, .password-store, .git-credentials,
  ~/Library/Keychains), and give sandboxed commands a writable scratch dir
  (private tmpfs pinned via TMPDIR/TMP/TEMP under bubblewrap; a
  per-command scratch directory under seatbelt).
• Report sandbox_posture as not ok when CODEX_REASONIX_ALLOW_UNSANDBOXED
  is set.
• Make journal readEvents fail closed on unparseable lines instead of
  throwing a raw JSON parse error.
• Restore finalize and Reasonix usage compatibility: contracts, status
  parsing, server routing, and tool schemas accept current Reasonix usage
  responses again.

v0.2.0-rc.3

[0.2.0-rc.3] - 2026-08-03

Added

• Add worker_lane: "fast" | "deep" to reasonix_delegate; new tasks default
  to fast (Reasonix economy + normal session, direct-edit prompt with no
  plan/todo or worker-owned acceptance checks). The lane is persisted in the
  task execution profile and does not affect the TaskContractV1 hash.
• Add per-lane execution deadlines: fast 600 seconds, deep 3,600 seconds,
  override 60–14,400 seconds; resumes always use the stored value and the wait
  timeout never cancels a worker.
• Add byte-exact file_assertions to TaskContractV1 (exact UTF-8 content
  including newline, at most 64 KiB); evidence records only hash and byte
  length, never raw content.
• Add review metadata to the bounded review bundle and task view:
  required_review_criteria, review_revision, review_diff_sha256,
  worker_lane, and effective Reasonix work/session modes.
• Add read-only git check-ignore support with explicit repository-relative
  paths and only the safe quiet/verbose flags; stdin, path escapes, and unknown
  options are rejected.
• Migrate TaskRecord atomically to schemaVersion 4: v1/v2 records keep their
  historical max effort and 600-second deadline on the deep lane; v3 records
  keep stored effort/deadline and gain the deep lane; legacy minimal effort
  records remain readable.

Changed

• Remove minimal from the wire reasoning_effort enum and from new
  configuration; effort default precedence stays task field, then environment,
  then medium.
• Run one ACP process per repository and lane; the pool key and status
  verification cover the lane on create, resume, repair, and finalize.
• Fail fast on the fast lane when status or session events show Goal,
  AutoResearch, review/task skills, or subagents; the deep lane keeps Goal
  continuation while the bridge still owns scope scanning, verification,
  staging, commit, and final review.
• Treat untracked .reasonix/** as runtime metadata: excluded from changed
  files, diffs, review bundles, security scans, staging, and commits without
  any .gitignore; tracked changes or structured worker writes in the
  namespace stay forbidden.
• Replace git diff --no-index synthesis with a temporary index built from the
  base commit, producing one canonical tree/diff for tracked, untracked,
  deleted, and mode changes.
• Save the canonical review tree before review_required; finalize compares
  that snapshot before and after verification and then compares the staged
  tree — never git add -N.
• Accept every valid acceptance id in finalize approval, ignore automated ids
  for approval, and require all review-evidence criteria; foreign or missing
  review ids are rejected with the required list.
• Keep commit_failed for commit/ref failures only; verification failures
  without a commit return to repairable review_required and rollback only
  bridge-owned staging.

Fixed

• Prevent post-terminal status updates from overwriting a failed fast-lane
  task's phase.
• Keep exactly three tools; instructions and descriptions now steer Codex to
  the fast lane unless the task is genuinely long-horizon, to low as the
  lowest effort, and to copying required_review_criteria into finalize.

v0.1.1

Clarifies MCP routing so explicitly approved Reasonix implementation uses reasonix_delegate instead of being substituted with native Codex subagents. Native subagents remain the intended path for bounded parallel exploration, tests, triage, and summaries.

This is a metadata-only compatibility patch. TaskContractV1, tool schemas, domain validation, runtime behavior, sandbox policy, and task lifecycle are unchanged.

v0.1.0 — First stable release

The first stable release of the security-first Codex–Reasonix MCP/ACP bridge.

Highlights:

• exposes exactly reasonix_delegate, reasonix_control, and reasonix_inspect to Codex 0.146.0
• preserves immutable TaskContractV1, isolated worktrees, bounded evidence, and bridge-owned finalization
• validates Reasonix supervisor, ACP status, model, sandbox, and network capabilities fail closed
• uses official Reasonix v1.19.0 as the supported compatibility baseline
• removes the now-obsolete bundled Reasonix source patch

Verified with the full Linux/macOS Node 22/24 matrix, dependency audit, CodeQL, production stdio probe, official Reasonix v1.19.0 doctor, and a fresh Codex deferred-catalog smoke without invoking Reasonix work.

This release publishes to npm latest through GitHub OIDC trusted publishing with provenance and no npm token.

v0.1.0-rc.4

Fixes Codex 0.146.0 tool-schema compatibility while preserving strict domain validation.

• Advertises homogeneous verification argv arrays so reasonix_delegate remains visible.
• Publishes reasonix_control as a flat wire object and revalidates action-specific input through the strict domain union.
• Names all three MCP tools at the start of server instructions.

This prerelease publishes to the npm next tag through trusted publishing with provenance.

v0.1.0-rc.3

Fixed

• Accept the single-dash option spelling emitted by Go flag help.
• Align the strict ACP status schema with the upstream sandbox availability field and fail closed when unavailable.

Compatibility

Validated against Reasonix main-v2 at 3d9e13f5 with planner off, Delivery and Goal modes, bubblewrap enforcement, a single workspace write root, and network disabled.

Install

npm install codex-reasonix-mcp@next

This remains a prerelease and requires a compatible Reasonix build containing esengine/DeepSeek-Reasonix#7097.

v0.1.0-rc.2

Fixed

• execute serve, doctor, and version correctly through npx and node_modules/.bin symlinks
• add unit and packaged-bin regression checks
• centralize the bridge version used in ACP client metadata

Compatibility

Reasonix upstream PR #7097 is merged into main-v2. Until an official Reasonix CLI release includes that merge, use a local build from current main-v2.

This prerelease is published to npm under the next dist-tag through OIDC trusted publishing with provenance.

v0.1.0-rc.1 — Initial prerelease

Codex–Reasonix MCP 0.1.0-rc.1

Initial public prerelease of the security-first MCP bridge for Codex-supervised Reasonix ACP workers.

Highlights

• immutable TaskContractV1 contracts with deterministic Goal rendering
• isolated Git branches/worktrees, private state, leases, redacted journals, and restart recovery
• three stable MCP tools for delegation, control, and bounded inspection
• fail-closed Reasonix ACP status/capability verification
• scoped permissions, secret scanning, argv-only verification, explicit staging, and one atomic commit
• offline fake-agent, protocol, unit, Git integration, and end-to-end coverage

Install

codex mcp add reasonix-worker -- npx -y codex-reasonix-mcp@0.1.0-rc.1

This prerelease requires a Reasonix binary containing the ACP supervisor extension from Reasonix PR #7097. The stable npm tag remains intentionally unpublished until a compatible Reasonix release is available.

See the changelog for the complete security and feature summary.