Keep bundled and reviewed-checkout skills out of Codex runs

[ppXD]

Summary

• Every Codex invocation (exec and exec resume) now carries -c skills.bundled.enabled=false. The pinned 0.142.2 installs five skills of its own under CODEX_HOME/skills/.system on every start and lists them to the model. A $name anywhere in the goal injects that skill's SKILL.md into the turn before the model acts: mid-word, after a backslash, in backticks, or as [$name](path). exec has no structured input and no setting turns the mention scan off, so the fix narrows which skills a mention can reach.
• An output reviewer (AgentTask.ExcludeRepositoryInstructions) also switches off every skill its reviewed checkout holds, using -c skills.config path rules (CodexHarness.AppendRepositorySkillExclusion).
  • It covers .agents/skills and .codex/skills. The CLI reads .codex/skills even when the workspace is marked untrusted.
  • Before this change, a producer-chosen file name such as notes/$approve-all.md in the reviewer's goal injected a skill the reviewed party wrote.
  • CodexRepositorySkills finds the files the way codex-rs 0.142.2 does: breadth first, six levels down, dot-named entries skipped, linked directories followed. It keys each path both as given and as the kernel resolves it.
  • Path rules keep a persona skill that shares a name with a checkout skill. Without them, that shared name makes the persona's mention ambiguous and neither skill is injected.
• A skill folder holding more directories than the CLI reads under one root (2000) is refused with the new failure code codex_skill_scan_truncated. Past that limit, which skills the CLI loads depends on the order it reads them; an output review then falls back to the model critic. McpDeclarationWriter.TomlString now escapes every control character, so a directory name cannot make the rules unparseable.
• Runs that load repository instructions are unchanged apart from the bundled-skill override. Persona skills and a repository's own skills still load for them.

Test plan

• Unit: CodexRepositorySkillsTests (9 tests):
  • one rule per skill, under both workspace spellings; an ordinary run keeps the checkout's skills
  • walk parity with the 0.142.2 skill placements measured on the real CLI
  • refusal at the directory limit and no refusal one below it; control-character quoting
  • pinned constants and failure code
• Unit: CodexHarnessTests shape theories
• Full unit suite: 13394/13394
• Integration: OutputReviewIntegrityFlowTests, AgentHarnessRegistrationTests, RealHarnessCodexMultiRepoGuidesTests, RealHarnessSkillProjectionTests, RealModelRunClassifierTests, AgentFolderDoubleFidelityTests (91/91)
• Real-CLI E2E, codex 0.142.2 against a loopback broker:
  • GoalChannelE2ETests fresh and resumed arms, each with its positive control
  • new reviewer arm, which runs the production output-reviewer task over a checkout with a skill in each root, one behind a link and one named like the persona's skill
  • the reviewer arm's control drops the path rules and must list and inject each skill and leave the persona ambiguous; as built, none is listed or injected and the persona is
• Mutation: rule paths that match nothing, and name rules used instead of path rules, each fail the reviewer arm. Removing any part of the walk fails a unit test.
• Sandbox lane (Linux, bubblewrap, root): sandbox-isolation.yml expects ≥111 tests and requires the skill-mentions codex-cli review Confined … codex=<pin> marker