Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion bin/omarchy-agent-usage-codex
Original file line number Diff line number Diff line change
Expand Up @@ -527,8 +527,13 @@ def fetch_codex_rpc():
return result

try:
# Codex 0.149 dropped "untrusted" from --ask-for-approval, which made this
# spawn exit before answering initialize and left the limits meters empty.
# This poller is detached: an approval prompt can never be answered, so
# "never" plus the read-only sandbox is both valid across CLI versions and
# the only policy that cannot stall the poll.
proc = subprocess.Popen(
[codex, "-s", "read-only", "-a", "untrusted", "app-server"],
[codex, "-s", "read-only", "-a", "never", "app-server"],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
stderr=subprocess.DEVNULL,
Expand Down
15 changes: 15 additions & 0 deletions test/shell.d/agent-usage-codex-scanner-test.sh
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ mkdir -p "$TEST_HOME/.codex/sessions/$(date +%Y/%m/%d)" "$TEST_HOME/bin"
cat >"$TEST_HOME/bin/codex" <<'EOF'
#!/bin/bash

[[ -n $CODEX_SPAWN_LOG ]] && printf '%s\n' "$*" >>"$CODEX_SPAWN_LOG"

while read -r request; do
id=$(jq -r '.id // empty' <<<"$request")
method=$(jq -r '.method // empty' <<<"$request")
Expand Down Expand Up @@ -55,6 +57,19 @@ pass "Codex collector does not double-count cache or reasoning tokens"
fail "Codex collector identifies itself with an empty limits list" "$result"
pass "Codex collector identifies itself with an empty limits list"

# Codex 0.149 dropped "untrusted" from --ask-for-approval, which made the
# app-server exit before answering initialize and left the limits meters dark.
# The poller is detached, so its policy must also be one that cannot prompt.
CODEX_SPAWN_LOG="$TEST_HOME/codex-spawn.log" \
HOME="$TEST_HOME" CODEX_HOME="$TEST_HOME/.codex" XDG_DATA_HOME="$TEST_HOME/.local/share" PATH="$TEST_HOME/bin:$PATH" \
"$ROOT/bin/omarchy-agent-usage-codex" >/dev/null
grep -q -- '-a never' "$TEST_HOME/codex-spawn.log" ||
fail "Codex collector spawns app-server with a prompt-free approval policy" "$(cat "$TEST_HOME/codex-spawn.log")"
if grep -q 'untrusted' "$TEST_HOME/codex-spawn.log"; then
fail "Codex collector still spawns app-server with the removed untrusted policy" "$(cat "$TEST_HOME/codex-spawn.log")"
fi
pass "Codex collector spawns app-server with a prompt-free approval policy"

# Pi and omp can both spend a Codex subscription without creating native
# Codex sessions. Their compatible JSONL transcripts must be included.
PI_HOME=$(mktemp -d)
Expand Down