feat: add standalone probe binaries + JSONL parser for /codex and /autoplan (issue #1329)

Extracts the logic from gstack-codex-probe bash functions and the inline Python
JSONL streaming parser into individually-executable binaries so skill templates
can call them directly without triggering Claude Code PreToolUse security hooks.

New binaries (all in bin/):
- gstack-codex-auth-probe: multi-signal auth check (exit 0=ok, 1=failed)
- gstack-codex-version-check: warns on known-bad Codex CLI versions
- gstack-codex-log-event: telemetry emitter (reads config internally, no _TEL env)
- gstack-codex-log-hang: operational learning writer on codex timeout
- gstack-codex-timeout-wrapper: gtimeout/timeout/unwrapped fallback chain
- gstack-codex-jsonl-parser: Python script parsing codex --json streaming output
  with --mode challenge (completeness check) and --mode consult (SESSION_ID extract)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: NikhileshNanduri

bin/gstack-codex-auth-probe

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# gstack-codex-auth-probe: standalone auth check. Prints AUTH_OK (exit 0) or
+# AUTH_FAILED (exit 1). Replaces _gstack_codex_auth_probe() from gstack-codex-probe
+# for skill templates that cannot safely source the probe file.
+#
+# Multi-signal: env vars OR auth file. Avoids false negatives for env-auth users
+# (CI, platform engineers) that a file-only check would reject.
+_codex_home="${CODEX_HOME:-$HOME/.codex}"
+_k1=$(printf '%s' "${CODEX_API_KEY:-}" | tr -d '[:space:]')
+_k2=$(printf '%s' "${OPENAI_API_KEY:-}" | tr -d '[:space:]')
+if [ -n "$_k1" ] || [ -n "$_k2" ] || [ -f "$_codex_home/auth.json" ]; then
+  echo "AUTH_OK"
+  exit 0
+fi
+echo "AUTH_FAILED"
+exit 1

bin/gstack-codex-jsonl-parser

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""
+gstack-codex-jsonl-parser: parse Codex CLI --json streaming output to human-readable form.
+
+Usage: gstack-codex-jsonl-parser [--mode challenge|consult]
+  Reads JSONL from stdin (codex exec --json output), prints formatted lines to stdout.
+
+Modes:
+  challenge  Track turn.completed count; warn on disconnect (no events received).
+  consult    Extract SESSION_ID from thread.started for follow-up sessions.
+"""
+import sys
+import json
+
+mode = "consult"
+args = sys.argv[1:]
+i = 0
+while i < len(args):
+    if args[i] == "--mode" and i + 1 < len(args):
+        mode = args[i + 1]
+        i += 2
+    else:
+        i += 1
+
+turn_completed_count = 0
+for line in sys.stdin:
+    line = line.strip()
+    if not line:
+        continue
+    try:
+        obj = json.loads(line)
+        t = obj.get("type", "")
+        if t == "thread.started" and mode == "consult":
+            tid = obj.get("thread_id", "")
+            if tid:
+                print(f"SESSION_ID:{tid}", flush=True)
+        elif t == "item.completed" and "item" in obj:
+            item = obj["item"]
+            itype = item.get("type", "")
+            text = item.get("text", "")
+            if itype == "reasoning" and text:
+                print(f"[codex thinking] {text}", flush=True)
+                print(flush=True)
+            elif itype == "agent_message" and text:
+                print(text, flush=True)
+            elif itype == "command_execution":
+                cmd = item.get("command", "")
+                if cmd:
+                    print(f"[codex ran] {cmd}", flush=True)
+        elif t == "turn.completed":
+            turn_completed_count += 1
+            usage = obj.get("usage", {})
+            tokens = usage.get("input_tokens", 0) + usage.get("output_tokens", 0)
+            if tokens:
+                print(f"\ntokens used: {tokens}", flush=True)
+    except Exception:
+        pass
+
+if mode == "challenge" and turn_completed_count == 0:
+    print(
+        "[codex warning] No turn.completed event received — possible mid-stream disconnect.",
+        flush=True,
+        file=sys.stderr,
+    )

bin/gstack-codex-log-event

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# gstack-codex-log-event: standalone telemetry emitter. Replaces
+# _gstack_codex_log_event() from gstack-codex-probe for skill templates
+# that cannot safely source the probe file.
+#
+# Usage: gstack-codex-log-event <event> [duration_s]
+# Event types: codex_timeout, codex_auth_failed, codex_cli_missing,
+#              codex_version_warning.
+# Payload: {skill, event, duration_s, ts}. NEVER includes prompt content,
+# env var values, or auth tokens.
+_event="${1:-unknown}"
+_duration="${2:-0}"
+_bin_dir="$(cd "$(dirname "$0")" && pwd)"
+_TEL=$("$_bin_dir/gstack-config" get telemetry 2>/dev/null || echo "off")
+[ "$_TEL" = "off" ] && exit 0
+mkdir -p "$HOME/.gstack/analytics" 2>/dev/null || exit 0
+_ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo unknown)
+printf '{"skill":"codex","event":"%s","duration_s":"%s","ts":"%s"}\n' \
+  "$_event" "$_duration" "$_ts" \
+  >> "$HOME/.gstack/analytics/skill-usage.jsonl" 2>/dev/null || true

bin/gstack-codex-log-hang

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# gstack-codex-log-hang: standalone hang logger. Replaces _gstack_codex_log_hang()
+# from gstack-codex-probe for skill templates that cannot safely source the probe.
+#
+# Usage: gstack-codex-log-hang <mode> [prompt_size]
+# Invoked when a codex invocation times out (exit 124). Records an operational
+# learning so future /investigate sessions surface the pattern. Best-effort.
+_mode="${1:-unknown}"
+_prompt_size="${2:-0}"
+_log_bin="$HOME/.claude/skills/gstack/bin/gstack-learnings-log"
+[ -x "$_log_bin" ] || exit 0
+_key="codex-hang-$(date +%s 2>/dev/null || echo unknown)"
+"$_log_bin" "$(printf '{"skill":"codex","type":"operational","key":"%s","insight":"Codex timed out after 600s during [%s] invocation. Prompt size: %s. Consider splitting prompt or checking network.","confidence":8,"source":"observed","files":["codex/SKILL.md.tmpl","autoplan/SKILL.md.tmpl"]}' "$_key" "$_mode" "$_prompt_size")" \
+  >/dev/null 2>&1 || true

bin/gstack-codex-timeout-wrapper

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# gstack-codex-timeout-wrapper: standalone timeout wrapper. Replaces
+# _gstack_codex_timeout_wrapper() from gstack-codex-probe for skill templates
+# that cannot safely source the probe file.
+#
+# Usage: gstack-codex-timeout-wrapper <duration_seconds> <command> [args...]
+# Resolves gtimeout (Homebrew coreutils on macOS) -> timeout (Linux) -> unwrapped.
+if [ "$#" -lt 2 ]; then
+  echo "Usage: gstack-codex-timeout-wrapper <duration> <command> [args...]" >&2
+  exit 1
+fi
+_duration="$1"
+shift
+_to=$(command -v gtimeout 2>/dev/null || command -v timeout 2>/dev/null || echo "")
+if [ -n "$_to" ]; then
+  "$_to" "$_duration" "$@"
+else
+  "$@"
+fi

bin/gstack-codex-version-check

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# gstack-codex-version-check: standalone version check. Warns on known-bad Codex
+# CLI versions. Replaces _gstack_codex_version_check() from gstack-codex-probe.
+#
+# Anchored regex prevents false positives like 0.120.10 or 0.120.20.
+# Update the pattern when a new Codex CLI version regresses.
+_ver=$(codex --version 2>/dev/null | head -1)
+[ -z "$_ver" ] && exit 0
+if echo "$_ver" | grep -Eq '(^|[^0-9.])0\.120\.(0|1|2)([^0-9.]|$)'; then
+  echo "WARN: Codex CLI $_ver has known stdin deadlock bugs. Run: npm install -g @openai/codex@latest"
+fi
+exit 0