Additional testing with codex

entry

@@ -104876,8 +104876,7 @@ var messageHandlers = {
 };
 
 // agents/codex.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { mkdirSync as mkdirSync3 } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync } from "node:fs";
 import { join as join6 } from "node:path";
 
 // ../node_modules/.pnpm/@openai+codex-sdk@0.58.0/node_modules/@openai/codex-sdk/dist/index.js
@@ -105204,6 +105203,34 @@ var Codex = class {
 };
 
 // agents/codex.ts
+function writeCodexConfig({ tempHome, mcpServers, isPublicRepo }) {
+  const codexDir = join6(tempHome, ".codex");
+  mkdirSync3(codexDir, { recursive: true });
+  const configPath = join6(codexDir, "config.toml");
+  const mcpServerSections = [];
+  for (const [name, config4] of Object.entries(mcpServers)) {
+    if (config4.type !== "http") continue;
+    log.info(`\xBB Adding MCP server '${name}' at ${config4.url}`);
+    mcpServerSections.push(`[mcp_servers.${name}]
+url = "${config4.url}"`);
+  }
+  const shellPolicy = isPublicRepo ? `[shell_environment_policy]
+ignore_default_excludes = false` : "";
+  writeFileSync(
+    configPath,
+    `# written by pullfrog
+${shellPolicy}
+
+${mcpServerSections.join("\n\n")}
+`.trim() + "\n"
+  );
+  if (isPublicRepo) {
+    log.info(`\xBB Codex config written to ${configPath} (env filtering: enabled)`);
+  } else {
+    log.info(`\xBB Codex config written to ${configPath} (private repo: no env filtering)`);
+  }
+  return codexDir;
+}
 var codex = agent({
   name: "codex",
   install: async () => {
@@ -105217,11 +105244,17 @@ var codex = agent({
     const tempHome = process.env.PULLFROG_TEMP_DIR;
     const configDir = join6(tempHome, ".config", "codex");
     mkdirSync3(configDir, { recursive: true });
+    const codexDir = writeCodexConfig({
+      tempHome,
+      mcpServers,
+      isPublicRepo: repo.isPublic
+    });
     setupProcessAgentEnv({
       OPENAI_API_KEY: apiKey,
-      HOME: tempHome
+      HOME: tempHome,
+      CODEX_HOME: codexDir
+      // point Codex to our config directory
     });
-    configureCodexMcpServers({ mcpServers, cliPath });
     const codexOptions = {
       apiKey,
       codexPathOverride: cliPath
@@ -105229,11 +105262,6 @@ var codex = agent({
     if (payload.sandbox) {
       log.info("\u{1F512} sandbox mode enabled: restricting to read-only operations");
     }
-    if (repo.isPublic) {
-      log.info(
-        "\u{1F512} public repo: instructions direct to MCP bash (native shell NOT disabled in SDK)"
-      );
-    }
     const codex2 = new Codex(codexOptions);
     const thread = codex2.startThread(
       payload.sandbox ? {
@@ -105354,32 +105382,10 @@ var messageHandlers2 = {
     log.error(`Error: ${event.message}`);
   }
 };
-function configureCodexMcpServers({ mcpServers, cliPath }) {
-  for (const [serverName, serverConfig] of Object.entries(mcpServers)) {
-    if (serverConfig.type === "http") {
-      const addArgs = ["mcp", "add", serverName, "--url", serverConfig.url];
-      log.info(`Adding MCP server '${serverName}' at ${serverConfig.url}...`);
-      const addResult = spawnSync2("node", [cliPath, ...addArgs], {
-        stdio: "pipe",
-        encoding: "utf-8"
-      });
-      if (addResult.status !== 0) {
-        throw new Error(
-          `codex mcp add failed: ${addResult.stderr || addResult.stdout || "Unknown error"}`
-        );
-      }
-      log.info(`\u2713 MCP server '${serverName}' configured`);
-    } else {
-      throw new Error(
-        `Unsupported MCP server type for Codex: ${serverConfig.type || "unknown"}`
-      );
-    }
-  }
-}
 
 // agents/cursor.ts
 import { spawn as spawn3 } from "node:child_process";
-import { mkdirSync as mkdirSync4, writeFileSync } from "node:fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join7 } from "node:path";
 var cursor = agent({
@@ -105554,7 +105560,7 @@ function configureCursorMcpServers({ mcpServers }) {
       url: serverConfig.url
     };
   }
-  writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers: cursorMcpServers }, null, 2), "utf-8");
+  writeFileSync2(mcpConfigPath, JSON.stringify({ mcpServers: cursorMcpServers }, null, 2), "utf-8");
   log.info(`\xBB MCP config written to ${mcpConfigPath}`);
 }
 function configureCursorSandbox({
@@ -105577,14 +105583,14 @@ function configureCursorSandbox({
       deny: denyShell
     }
   };
-  writeFileSync(cliConfigPath, JSON.stringify(config4, null, 2), "utf-8");
+  writeFileSync2(cliConfigPath, JSON.stringify(config4, null, 2), "utf-8");
   log.info(
     `\xBB CLI config written to ${cliConfigPath} (sandbox: ${sandbox}, isPublicRepo: ${isPublicRepo})`
   );
 }
 
 // agents/gemini.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join8 } from "node:path";
 
@@ -105869,12 +105875,12 @@ function configureGeminiMcpServers({ mcpServers, isPublicRepo }) {
   if (isPublicRepo) {
     newSettings.excludeTools = ["run_shell_command"];
   }
-  writeFileSync2(settingsPath, JSON.stringify(newSettings, null, 2), "utf-8");
+  writeFileSync3(settingsPath, JSON.stringify(newSettings, null, 2), "utf-8");
   log.info(`\xBB MCP config written to ${settingsPath}`);
 }
 
 // agents/opencode.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 var opencode = agent({
   name: "opencode",
@@ -106051,7 +106057,7 @@ function configureOpenCode({ mcpServers, sandbox, isPublicRepo }) {
   };
   const configJson = JSON.stringify(config4, null, 2);
   try {
-    writeFileSync3(configPath, configJson, "utf-8");
+    writeFileSync4(configPath, configJson, "utf-8");
   } catch (error50) {
     log.error(
       `failed to write OpenCode config to ${configPath}: ${error50 instanceof Error ? error50.message : String(error50)}`
@@ -136258,14 +136264,14 @@ var FastMCP = class extends FastMCPEventEmitter {
 };
 
 // mcp/checkout.ts
-import { writeFileSync as writeFileSync4 } from "node:fs";
+import { writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join10 } from "node:path";
 
 // utils/shell.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 function $(cmd, args3, options) {
   const encoding = options?.encoding ?? "utf-8";
-  const result = spawnSync3(cmd, args3, {
+  const result = spawnSync2(cmd, args3, {
     stdio: ["ignore", "pipe", "pipe"],
     encoding,
     cwd: options?.cwd,
@@ -136453,7 +136459,7 @@ ${diffPreview}`);
         );
       }
       const diffPath = join10(tempDir, `pr-${pull_number}.diff`);
-      writeFileSync4(diffPath, diffContent);
+      writeFileSync5(diffPath, diffContent);
       log.debug(`wrote diff to ${diffPath} (${diffContent.length} bytes)`);
       return {
         success: true,
@@ -138529,6 +138535,7 @@ function resolveAgent({
   repoSettings
 }) {
   const agentOverride = process.env.AGENT_OVERRIDE;
+  log.debug(`\xBB determineAgent: agentOverride=${agentOverride}, payload.agent=${payload.agent}, repoSettings.defaultAgent=${repoSettings.defaultAgent}`);
   const configuredAgentName = agentOverride || payload.agent || repoSettings.defaultAgent || null;
   if (configuredAgentName) {
     const agent3 = agents[configuredAgentName];