From 16435addb3ab66140bbd3f3fa7bf39e01771174f Mon Sep 17 00:00:00 2001
From: yashrajbasav <yashrajbasav@nvidia.com>
Date: Mon, 5 Oct 2026 10:46:11 +0530
Subject: [PATCH 1/2] fix(security): fail closed for unsafe Codex CLI analysis

Signed-off-by: yashrajbasav <yashrajbasav@nvidia.com>
---
 src/skillspector/providers/_agent_cli.py      |  78 +++---------
 .../providers/codex_cli/provider.py           |  24 +---
 tests/unit/test_agent_cli.py                  | 117 ++++--------------
 3 files changed, 47 insertions(+), 172 deletions(-)

diff --git a/src/skillspector/providers/_agent_cli.py b/src/skillspector/providers/_agent_cli.py
index e69d71c2b..206be2b9f 100644
--- a/src/skillspector/providers/_agent_cli.py
+++ b/src/skillspector/providers/_agent_cli.py
@@ -26,8 +26,8 @@
   adversarial skill content) is written to the process stdin, never
   injected into argv.
 - **Capability stripping** (per-binary): tools disabled, MCP disabled,
-  no extra directories, deny permission mode (claude); read-only sandbox
-  (codex).  ``--dangerously-skip-permissions`` is NEVER used.
+  no extra directories, deny permission mode (claude). Codex is disabled
+  until a complete no-tools policy is verified.  ``--dangerously-skip-permissions`` is NEVER used.
 - **Environment scrubbing**: API keys, SSH keys, cloud credentials, and
   other secrets are stripped from the child environment.
 - **Timeout enforcement**: the call raises ``TimeoutError`` rather than
@@ -276,60 +276,21 @@ def _parse_claude_output(raw: str) -> str:
 # ---------------------------------------------------------------------------
 
 
-def _build_codex_argv(binary: str, model: str, max_output_tokens: int = 0) -> list[str]:
-    """Build the argv list for a capability-stripped ``codex exec`` call.
-
-    Flags chosen (verified end-to-end against codex 0.139.0):
-
-    ``exec``
-        Non-interactive subcommand. With NO positional prompt, codex reads the
-        instructions from stdin — which is exactly where the runner pipes the
-        prompt. (Passing ``-`` makes the prompt literally ``"-"`` and demotes
-        the real content to a ``<stdin>`` block, so we do not pass it.)
-
-    ``--json``
-        Emit JSONL events to stdout, enabling structured parsing.
-
-    ``--sandbox read-only``
-        Most restrictive sandbox mode. Model-generated shell commands are
-        restricted to read-only filesystem access; no code execution. Unlike
-        claude/gemini (which block model tool use entirely), codex's strictest
-        mode still permits read-only filesystem *reads* by model-generated
-        commands. This is informational, not an exfil channel: the call runs in
-        an isolated empty temp CWD, output returns only to the operator's own
-        report, and there is no network egress path.
-
-    ``--ephemeral``
-        Do not persist session files to disk (no residue from the scan).
-
-    ``--ignore-user-config``
-        Ignore ``$CODEX_HOME/config.toml``; use only our explicit flags.
+_CODEX_DISABLED_REASON = (
+    "codex_cli is disabled: its read-only sandbox still permits commands to read "
+    "host files, and SkillSpector has no verified deny-all-tools policy for Codex. "
+    "Use an HTTP API provider or another supported CLI provider instead."
+)
 
-    ``--ignore-rules``
-        Do not load user/project ``.rules`` files.
 
-    ``--model <label>``
-        Use the requested model.
+def _build_codex_argv(binary: str, model: str, max_output_tokens: int = 0) -> list[str]:
+    """Refuse inference until all model tool execution can be disabled.
 
-    ``-m`` / ``--model`` label is validated via ``_validate_model_label``.
+    Read-only access is insufficient for untrusted prompts: host file contents
+    can leave through the model response. Disabling one shell feature does not
+    establish a deny-all policy for other or future tools.
     """
-    return [
-        binary,
-        "exec",
-        "--json",
-        "--sandbox",
-        "read-only",
-        # We run in an isolated empty temp dir (not a git repo); codex refuses
-        # an "untrusted" dir without this. Safe: --sandbox read-only still bars
-        # code execution, and the temp dir holds no project files.
-        "--skip-git-repo-check",
-        "--ephemeral",
-        "--ignore-user-config",
-        "--ignore-rules",
-        # --model omitted by default -> codex uses the account's default model
-        # (forwarded only when SKILLSPECTOR_MODEL is set).
-        *(["--model", _validate_model_label(model)] if model else []),
-    ]
+    raise AgentCLIError(_CODEX_DISABLED_REASON)
 
 
 def _parse_codex_output(raw: str) -> str:
@@ -794,17 +755,8 @@ def _claude_auth_check(binary: str) -> tuple[bool, str | None]:
 
 
 def _codex_auth_check(binary: str) -> tuple[bool, str | None]:
-    """Check codex is authenticated via ``codex login status`` (no inference)."""
-    try:
-        result = subprocess.run(
-            [binary, "login", "status"], capture_output=True, shell=False, timeout=15
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError, OSError) as exc:
-        return False, f"codex login status check failed: {exc}"
-    out = (result.stdout or b"").decode("utf-8", errors="replace").lower()
-    if result.returncode != 0 or "not logged in" in out:
-        return False, "codex is not authenticated (run `codex login`)"
-    return True, None
+    """Report Codex unavailable without starting a process (fail closed)."""
+    return False, _CODEX_DISABLED_REASON
 
 
 def _gemini_auth_check(binary: str) -> tuple[bool, str | None]:
diff --git a/src/skillspector/providers/codex_cli/provider.py b/src/skillspector/providers/codex_cli/provider.py
index 2ffb75911..0668daa3f 100644
--- a/src/skillspector/providers/codex_cli/provider.py
+++ b/src/skillspector/providers/codex_cli/provider.py
@@ -13,18 +13,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Codex CLI provider — Stage-2 LLM analysis via the local ``codex`` binary.
-
-Activated by ``SKILLSPECTOR_PROVIDER=codex_cli``. Authentication is handled by
-the ``codex`` CLI's own session (``codex login``); no API key is read or
-required.
-
-All behaviour is inherited from
-:class:`skillspector.providers._agent_cli_base.AgentCLIProviderBase`; the
-"codex"-specific argv (``codex exec --json --sandbox read-only --ephemeral
---ignore-user-config --ignore-rules``; never ``--dangerously-bypass-*``),
-output parsing, and auth probe live in the
-:mod:`skillspector.providers._agent_cli` registry.
+"""Codex CLI provider — registered but disabled for untrusted skill analysis.
+
+A read-only sandbox permits host file reads. Inference remains disabled until
+SkillSpector can verify a complete no-tools policy; the shared registry reports
+this provider unavailable and rejects direct completion calls before spawning.
 """
 
 from __future__ import annotations
@@ -35,11 +28,6 @@
 
 
 class CodexCLIProvider(AgentCLIProviderBase):
-    """Codex CLI provider (no API key; uses the local ``codex`` login).
-
-    No model is pinned: ``codex`` runs with the account's own default model
-    (some models, e.g. ``o4-mini``, aren't valid for ChatGPT-account codex, so
-    pinning is fragile). Set ``SKILLSPECTOR_MODEL`` to override.
-    """
+    """Registered provider that fails closed until tool denial is verified."""
 
     BINARY_NAME = "codex"
diff --git a/tests/unit/test_agent_cli.py b/tests/unit/test_agent_cli.py
index 4e1c73cb4..68820a547 100644
--- a/tests/unit/test_agent_cli.py
+++ b/tests/unit/test_agent_cli.py
@@ -22,8 +22,7 @@
   - Untrusted content is passed via stdin, never in argv
   - Capability-stripping flags (--allowed-tools "" deny-by-default,
     --permission-mode dontAsk, --strict-mcp-config, --disable-slash-commands for
-    claude; --sandbox read-only, --ephemeral, --ignore-user-config, --ignore-rules
-    for codex) are present in argv
+    claude) are present in argv; Codex is rejected before any subprocess starts
   - --dangerously-skip-permissions is NEVER in argv
   - A timeout parameter is set
   - Environment passed to the child is scrubbed of API keys and secrets
@@ -228,40 +227,10 @@ def test_no_injection_in_argv(self) -> None:
 
 
 class TestBuildCodexArgv:
-    def test_exec_subcommand(self) -> None:
-        argv = _build_codex_argv(CODEX_BINARY, "o4-mini")
-        assert "exec" in argv
-
-    def test_json_flag_present(self) -> None:
-        argv = _build_codex_argv(CODEX_BINARY, "o4-mini")
-        assert "--json" in argv
-
-    def test_sandbox_read_only(self) -> None:
-        argv = _build_codex_argv(CODEX_BINARY, "o4-mini")
-        assert "--sandbox" in argv
-        idx = argv.index("--sandbox")
-        assert argv[idx + 1] == "read-only"
-
-    def test_ephemeral_present(self) -> None:
-        argv = _build_codex_argv(CODEX_BINARY, "o4-mini")
-        assert "--ephemeral" in argv
-
-    def test_ignore_user_config_present(self) -> None:
-        argv = _build_codex_argv(CODEX_BINARY, "o4-mini")
-        assert "--ignore-user-config" in argv
-
-    def test_ignore_rules_present(self) -> None:
-        argv = _build_codex_argv(CODEX_BINARY, "o4-mini")
-        assert "--ignore-rules" in argv
-
-    def test_dangerous_bypass_never_present(self) -> None:
-        argv = _build_codex_argv(CODEX_BINARY, "o4-mini")
-        full_cmd = " ".join(argv)
-        assert "dangerously" not in full_cmd.lower()
-
-    def test_setting_sources_flag_absent(self) -> None:
-        argv = _build_codex_argv(CODEX_BINARY, "o4-mini")
-        assert "--setting-sources=" not in argv
+    @pytest.mark.parametrize("model", ["", "o4-mini", "--dangerously-bypass-approvals-and-sandbox"])
+    def test_disabled_for_every_model(self, model: str) -> None:
+        with pytest.raises(AgentCLIError, match="codex_cli is disabled"):
+            _build_codex_argv(CODEX_BINARY, model)
 
 
 # ---------------------------------------------------------------------------
@@ -309,7 +278,7 @@ def test_preserves_safe_vars(self, monkeypatch: pytest.MonkeyPatch) -> None:
         assert "PATH" in env
         assert "HOME" in env
 
-    @pytest.mark.parametrize("binary_name", ["claude", "codex", "gemini"])
+    @pytest.mark.parametrize("binary_name", ["claude", "gemini"])
     @pytest.mark.parametrize("lowercase", [False, True])
     def test_project_credentials_never_reach_child(
         self, monkeypatch: pytest.MonkeyPatch, binary_name: str, lowercase: bool
@@ -325,7 +294,7 @@ def test_project_credentials_never_reach_child(
             monkeypatch.setenv(key, "synthetic-credential")
         monkeypatch.setenv("SKILLSPECTOR_MODEL", "test-model")
         monkeypatch.setenv("SKILLSPECTOR_COMPAT_BASE_URL", "https://example.invalid")
-        output = _GOOD_CODEX_JSONL if binary_name == "codex" else _GOOD_CLAUDE_OUTPUT
+        output = _GOOD_CLAUDE_OUTPUT
         with (
             patch(
                 "skillspector.providers._agent_cli.find_binary", return_value="/usr/bin/mock-cli"
@@ -506,60 +475,26 @@ def test_dangerously_skip_permissions_never_in_argv(
         assert "dangerously_skip_permissions" not in full_argv
 
 
-@patch("skillspector.providers._agent_cli.find_binary", return_value=CODEX_BINARY)
-@patch("skillspector.providers._agent_cli.subprocess.Popen")
 class TestRunAgentCLICodex:
-    def test_shell_is_false(self, mock_popen: MagicMock, _mock_binary: MagicMock) -> None:
-        mock_popen.return_value = _make_ok_process(_GOOD_CODEX_JSONL.encode())
-        run_agent_cli("codex", PROMPT, model="o4-mini")
-        call_kwargs = mock_popen.call_args[1]
-        assert call_kwargs.get("shell") is False
-
-    def test_prompt_in_stdin_not_argv(self, mock_popen: MagicMock, _mock_binary: MagicMock) -> None:
-        proc = _make_ok_process(_GOOD_CODEX_JSONL.encode())
-        mock_popen.return_value = proc
-        run_agent_cli("codex", PROMPT, model="o4-mini")
-        argv = mock_popen.call_args[0][0]
-        assert PROMPT.encode("utf-8") in proc.stdin_bytes
-        for token in argv:
-            assert PROMPT not in str(token)
-
-    def test_timeout_is_set(self, mock_popen: MagicMock, _mock_binary: MagicMock) -> None:
-        proc = _make_ok_process(_GOOD_CODEX_JSONL.encode())
-        mock_popen.return_value = proc
-        run_agent_cli("codex", PROMPT, model="o4-mini")
-        proc.wait.assert_called_once()
-        timeout_arg = proc.wait.call_args.kwargs.get("timeout")
-        assert isinstance(timeout_arg, (int, float))
-        assert timeout_arg > 0
-
-    def test_env_scrubbed(
-        self, mock_popen: MagicMock, _mock_binary: MagicMock, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        monkeypatch.setenv("OPENAI_API_KEY", "sk-secret")
-        mock_popen.return_value = _make_ok_process(_GOOD_CODEX_JSONL.encode())
-        run_agent_cli("codex", PROMPT, model="o4-mini")
-        child_env = mock_popen.call_args[1].get("env", {})
-        assert "OPENAI_API_KEY" not in child_env
-
-    def test_nonzero_exit_raises(self, mock_popen: MagicMock, _mock_binary: MagicMock) -> None:
-        mock_popen.return_value = _make_ok_process(b"", returncode=1)
-        with pytest.raises(AgentCLIError, match="exited with code"):
-            run_agent_cli("codex", PROMPT, model="o4-mini")
-
-    def test_timeout_raises(self, mock_popen: MagicMock, _mock_binary: MagicMock) -> None:
-        mock_popen.return_value = _make_ok_process(
-            b"", wait_exc=subprocess.TimeoutExpired(cmd="codex", timeout=5)
-        )
-        with pytest.raises(AgentCLIError, match="timed out"):
-            run_agent_cli("codex", PROMPT, model="o4-mini")
-
-    def test_no_message_in_output_raises(
-        self, mock_popen: MagicMock, _mock_binary: MagicMock
-    ) -> None:
-        mock_popen.return_value = _make_ok_process(b'{"type": "done"}\n')
-        with pytest.raises(AgentCLIError, match="no assistant message"):
-            run_agent_cli("codex", PROMPT, model="o4-mini")
+    def test_rejects_untrusted_prompt_without_starting_process(self) -> None:
+        with (
+            patch("skillspector.providers._agent_cli.find_binary", return_value=CODEX_BINARY),
+            patch(
+                "skillspector.providers._agent_cli.subprocess.Popen",
+                side_effect=AssertionError("Codex must not start"),
+            ) as popen,
+            patch(
+                "skillspector.providers._agent_cli.subprocess.run",
+                side_effect=AssertionError("Codex must not start"),
+            ) as run,
+        ):
+            with pytest.raises(AgentCLIError, match="host files"):
+                run_agent_cli("codex", INJECTION_PAYLOAD, model="")
+            available, reason = _agent_cli.is_available("codex")
+        assert available is False
+        assert "disabled" in reason
+        popen.assert_not_called()
+        run.assert_not_called()
 
 
 # ---------------------------------------------------------------------------

From ce44b61bc9e580c613728cfff9ba66d1c937f3c6 Mon Sep 17 00:00:00 2001
From: yashrajbasav <yashrajbasav@nvidia.com>
Date: Mon, 5 Oct 2026 21:21:06 +0530
Subject: [PATCH 2/2] docs: mark the Codex CLI provider disabled

Signed-off-by: yashrajbasav <yashrajbasav@nvidia.com>
---
 .env.example                                     |  5 +++--
 README.md                                        | 13 +++++--------
 docs/DEVELOPMENT.md                              | 14 ++++++++------
 src/skillspector/cli.py                          |  7 ++++---
 src/skillspector/providers/__init__.py           |  2 +-
 src/skillspector/providers/_agent_cli.py         |  6 ++++--
 src/skillspector/providers/codex_cli/__init__.py | 12 ++++--------
 tests/integration/test_agent_cli_live.py         |  9 ++++++---
 8 files changed, 35 insertions(+), 33 deletions(-)

diff --git a/.env.example b/.env.example
index 581461142..fb1f7f71f 100644
--- a/.env.example
+++ b/.env.example
@@ -4,7 +4,8 @@ ENV=dev                                                         # options: dev|s
 # metadata, and default-model lookups.  Leave unset to default to nv_build.
 # Options: openai | anthropic | anthropic_proxy | bedrock | nv_build |
 #          ollama | azure_openai | openai_compatible | claude_cli |
-#          codex_cli | gemini_cli | opencode_cli
+#          gemini_cli | opencode_cli
+# codex_cli is registered but disabled: its read-only sandbox permits host-file reads.
 SKILLSPECTOR_PROVIDER=
 
 # Aggregate deadline for one complete scan workflow. Defaults to 600 seconds;
@@ -67,7 +68,7 @@ AZURE_OPENAI_ENDPOINT=
 SKILLSPECTOR_COMPAT_API_KEY=
 SKILLSPECTOR_COMPAT_BASE_URL=
 
-# claude_cli, codex_cli, gemini_cli, and opencode_cli use their CLI's existing local
+# claude_cli, gemini_cli, and opencode_cli use their CLI's existing local
 # authentication session and do not need an API key here.
 
 # SkillSpector config
diff --git a/README.md b/README.md
index ac9daf1ff..0e16cc482 100644
--- a/README.md
+++ b/README.md
@@ -295,7 +295,7 @@ inference gateways.
 | `azure_openai` | `AZURE_OPENAI_API_KEY` + `AZURE_OPENAI_ENDPOINT` | Azure OpenAI Service | `gpt-4o` (deployment defaults to the model label) |
 | `openai_compatible` | `SKILLSPECTOR_COMPAT_API_KEY` + `SKILLSPECTOR_COMPAT_BASE_URL` | Any OpenAI-compatible endpoint | `llama-3.1-70b-versatile` |
 | `claude_cli` | _(none — uses local CLI auth)_ | local `claude` binary | local Claude runtime fallback, or `SKILLSPECTOR_MODEL` |
-| `codex_cli` | _(none — uses local CLI auth)_ | local `codex` binary | local Codex runtime fallback, or `SKILLSPECTOR_MODEL` |
+| `codex_cli` | Disabled | Registered for compatibility; its read-only sandbox permits host-file reads | Use an HTTP API provider or another supported CLI provider |
 | `gemini_cli` | _(none — uses local CLI auth)_ | local `gemini` binary | local Gemini runtime fallback, or `SKILLSPECTOR_MODEL` |
 | `opencode_cli` | _(none — uses local CLI auth)_ | local `opencode` 1.18.33 binary | local OpenCode runtime fallback, or `SKILLSPECTOR_MODEL` |
 
@@ -359,11 +359,6 @@ export SKILLSPECTOR_PROVIDER=claude_cli
 # export SKILLSPECTOR_MODEL=claude-sonnet-4-6
 skillspector scan ./my-skill/
 
-# Local Codex CLI — no API key; uses your existing `codex login` session
-# Requires: codex CLI installed and authenticated
-export SKILLSPECTOR_PROVIDER=codex_cli
-skillspector scan ./my-skill/
-
 # Gemini (via OpenAI compatibility layer)
 export SKILLSPECTOR_PROVIDER=openai
 export OPENAI_API_KEY="YOUR_GEMINI_API_KEY"
@@ -679,7 +674,7 @@ Issues (2)
 
 | Variable | Description | Required |
 |----------|-------------|----------|
-| `SKILLSPECTOR_PROVIDER` | Active LLM provider: `openai`, `anthropic`, `anthropic_proxy`, `bedrock`, `nv_build`, `ollama`, `azure_openai`, `openai_compatible`, `claude_cli`, `codex_cli`, `gemini_cli`, or `opencode_cli`. Hosted providers use bundled `model_registry.yaml` defaults; CLI providers fall back to the local runtime's default model unless `SKILLSPECTOR_MODEL` is set. Defaults to `nv_build`. | Optional |
+| `SKILLSPECTOR_PROVIDER` | Active LLM provider: `openai`, `anthropic`, `anthropic_proxy`, `bedrock`, `nv_build`, `ollama`, `azure_openai`, `openai_compatible`, `claude_cli`, `gemini_cli`, or `opencode_cli`. Hosted providers use bundled `model_registry.yaml` defaults; CLI providers fall back to the local runtime's default model unless `SKILLSPECTOR_MODEL` is set. Defaults to `nv_build`. | Optional |
 | `NVIDIA_INFERENCE_KEY` | Credential for the `nv_build` provider (build.nvidia.com). | Required for LLM analysis when `SKILLSPECTOR_PROVIDER=nv_build` |
 | `OPENAI_API_KEY` | Credential for the OpenAI provider (`SKILLSPECTOR_PROVIDER=openai`). Also serves as the tier-2 fallback in the credential waterfall when the active provider returns no credentials. | Required for LLM analysis when `SKILLSPECTOR_PROVIDER=openai` |
 | `OPENAI_BASE_URL` | Override the OpenAI endpoint (e.g. point at Ollama). | Optional |
@@ -708,7 +703,9 @@ Issues (2)
 | `SKILLSPECTOR_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARNING`, `ERROR` (default: `WARNING`). | Optional |
 | `SKILLSPECTOR_MAX_DEPENDENCY_SOURCE_ANALYSIS_SECONDS` | Ceiling for the dependency-source analysis pass, in seconds. Defaults to `5.0`, which is the historical value. Raise it on slow or heavily loaded machines so the same unchanged tree does not come back partially inspected, which would set `safe_to_install` to false and record `runtime_limit`. The remaining aggregate workflow time (`SKILLSPECTOR_MAX_WORKFLOW_SECONDS`, 600 seconds by default) still caps the effective value; values above that remaining time have no effect. Invalid, zero, negative, infinite, and NaN values keep the 5-second default. The setting is resolved when the module is imported, so a new process is required after changing it. See [analysis resource bounds](docs/ANALYSIS_RESOURCE_BOUNDS.md#configuring-the-dependency-source-deadline). | Optional |
 
-> **CLI providers** (`claude_cli`, `codex_cli`, `gemini_cli`, `opencode_cli`): No API key is needed. Authentication is managed entirely by the agent CLI's own login session. SkillSpector never reads or forwards API keys when these providers are active. The subprocess is run with capabilities restricted, and untrusted skill content is delivered only via stdin.
+> **Disabled provider:** `codex_cli` remains registered but cannot run LLM analysis because its read-only sandbox allows host-file reads. Existing users should select an HTTP API provider or another supported CLI provider.
+
+> **CLI providers** (`claude_cli`, `gemini_cli`, `opencode_cli`): No API key is needed. Authentication is managed entirely by the agent CLI's own login session. SkillSpector never reads or forwards API keys when these providers are active. The subprocess is run with capabilities restricted, and untrusted skill content is delivered only via stdin.
 >
 > `opencode_cli` currently fails closed unless the installed OpenCode version is exactly `1.18.33`, the version whose configuration precedence and deny-all semantics are verified by this release.
 
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index 136c432b5..000402831 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -34,7 +34,7 @@ make install-dev
 
 - **Python**: 3.12+ (see [pyproject.toml](../pyproject.toml)). `make install` and `make install-dev` use **uv** if available (`uv sync` / `uv sync --all-extras`), otherwise **pip** (`pip install -e .` / `pip install -e ".[dev]"`). You must create and activate the virtual environment yourself before running any make target.
 - **Environment**: Optional `.env` in the project root. The LangGraph dev server loads it (see [langgraph.json](../langgraph.json) `"env": ".env"`). Key variables:
-  - **`SKILLSPECTOR_PROVIDER`**: Selects the active LLM provider — `openai`, `anthropic`, `anthropic_proxy`, `bedrock`, `nv_build`, `ollama`, `azure_openai`, `openai_compatible`, `claude_cli`, `codex_cli`, `gemini_cli`, or `opencode_cli`. Defaults to `nv_build` when unset.
+  - **`SKILLSPECTOR_PROVIDER`**: Selects the active LLM provider — `openai`, `anthropic`, `anthropic_proxy`, `bedrock`, `nv_build`, `ollama`, `azure_openai`, `openai_compatible`, `claude_cli`, `gemini_cli`, or `opencode_cli`. Defaults to `nv_build` when unset.
   - **Provider credential**: depends on the active provider. Hosted providers use the matching variables in [.env.example](../.env.example); Ollama and CLI providers do not require an API key. See [providers/](../src/skillspector/providers/).
   - **`OPENAI_BASE_URL`**: Override the OpenAI endpoint (e.g. point at Ollama).
   - **`SKILLSPECTOR_MODEL`**: Override default model; see [constants.py](../src/skillspector/constants.py).
@@ -296,7 +296,7 @@ Copy [.env.example](../.env.example) to `.env` in the project root and set value
 
 | Variable | Description | Example |
 |----------|-------------|---------|
-| `SKILLSPECTOR_PROVIDER` | Active LLM provider: `openai` \| `anthropic` \| `anthropic_proxy` \| `bedrock` \| `nv_build` \| `ollama` \| `azure_openai` \| `openai_compatible` \| `claude_cli` \| `codex_cli` \| `gemini_cli` \| `opencode_cli`. Defaults to `nv_build`. | `claude_cli` |
+| `SKILLSPECTOR_PROVIDER` | Active LLM provider: `openai` \| `anthropic` \| `anthropic_proxy` \| `bedrock` \| `nv_build` \| `ollama` \| `azure_openai` \| `openai_compatible` \| `claude_cli` \| `gemini_cli` \| `opencode_cli`. Defaults to `nv_build`. | `claude_cli` |
 | `NVIDIA_INFERENCE_KEY` | Credential for `nv_build`. | `nvapi-...` |
 | `OPENAI_API_KEY` | Credential for `SKILLSPECTOR_PROVIDER=openai`. Also tier-2 fallback for non-OpenAI providers. | `sk-...` |
 | `OPENAI_BASE_URL` | Override the OpenAI endpoint (e.g. point at Ollama). | `http://localhost:11434/v1` |
@@ -312,7 +312,9 @@ Copy [.env.example](../.env.example) to `.env` in the project root and set value
 | `SKILLSPECTOR_COMPAT_BASE_URL` | OpenAI-compatible endpoint base URL. | `https://api.groq.com/openai/v1` |
 | `SKILLSPECTOR_MODEL` | Override the active provider's bundled default model (see [README.md](../README.md) for per-provider defaults). CLI providers forward it as `--model`. | `gpt-5.2` |
 
-> **CLI providers** (`claude_cli`, `codex_cli`, `gemini_cli`, `opencode_cli`): no credential env var is needed. Authentication is managed by the agent CLI's own session. The subprocess is heavily sandboxed — see [providers/_agent_cli.py](../src/skillspector/providers/_agent_cli.py).
+> **Disabled provider:** `codex_cli` remains registered for compatibility but refuses inference until a complete no-tools policy is verified.
+
+> **CLI providers** (`claude_cli`, `gemini_cli`, `opencode_cli`): no credential env var is needed. Authentication is managed by the agent CLI's own session. The subprocess is heavily sandboxed — see [providers/_agent_cli.py](../src/skillspector/providers/_agent_cli.py).
 
 ### Live provider tests
 
@@ -343,15 +345,15 @@ Base URL env vars are not needed for live provider tests; the tests intentionall
   - `azure_openai/` — Azure OpenAI Service (`AZURE_OPENAI_API_KEY`, `AZURE_OPENAI_ENDPOINT`)
   - `openai_compatible/` — generic compatible endpoint (`SKILLSPECTOR_COMPAT_API_KEY`, `SKILLSPECTOR_COMPAT_BASE_URL`)
   - `claude_cli/` — **local `claude` binary; no API key**. Uses the CLI's own auth session (`claude auth login`). Set `SKILLSPECTOR_PROVIDER=claude_cli`.
-  - `codex_cli/` — **local `codex` binary; no API key**. Uses the CLI's own auth session (`codex login`). Set `SKILLSPECTOR_PROVIDER=codex_cli`.
+  - `codex_cli/` — **registered but disabled**. Its read-only sandbox permits host-file reads. Select an HTTP API provider or another supported CLI provider for LLM analysis.
   - `gemini_cli/` — **local `gemini` binary; no API key**. Uses the CLI's own auth session. Set `SKILLSPECTOR_PROVIDER=gemini_cli`.
   - `opencode_cli/` — **local `opencode` 1.18.33 binary; no API key**. Uses the CLI's own auth session (`opencode auth login`) and fails closed on every other runtime version because the deny-all policy is verified against that exact release. Set `SKILLSPECTOR_PROVIDER=opencode_cli`.
 
-  CLI providers (`claude_cli`, `codex_cli`, `gemini_cli`, `opencode_cli`) implement the optional `AgentCLICapable` interface (`is_available()` + `complete()`) defined in [providers/base.py](../src/skillspector/providers/base.py). `has_cli_capability(provider)` detects this at runtime. All subprocess calls go through the hardened helper [providers/_agent_cli.py](../src/skillspector/providers/_agent_cli.py) which enforces: no shell (`shell=False`), untrusted content via stdin only, capability stripping (tools disabled / sandboxed), environment scrubbing (no API keys forwarded), per-call timeout, and fail-closed error handling.
+  CLI providers (`claude_cli`, `gemini_cli`, `opencode_cli`) implement the optional `AgentCLICapable` interface (`is_available()` + `complete()`) defined in [providers/base.py](../src/skillspector/providers/base.py). `has_cli_capability(provider)` detects this at runtime. All subprocess calls go through the hardened helper [providers/_agent_cli.py](../src/skillspector/providers/_agent_cli.py) which enforces: no shell (`shell=False`), untrusted content via stdin only, capability stripping (tools disabled / sandboxed), environment scrubbing (no API keys forwarded), per-call timeout, and fail-closed error handling.
 
 - **LLM calls** ([llm_utils.py](../src/skillspector/llm_utils.py)): **`get_chat_model()`** and **`chat_completion()`** dispatch based on the active provider:
   - **HTTP providers**: resolve credentials in two tiers — active provider (`NVIDIA_INFERENCE_KEY` / `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` → endpoint) — against any OpenAI-compatible endpoint. `max_tokens` is auto-bound to `get_max_output_tokens(model)` from `model_info`.
-  - **CLI providers** (`claude_cli`, `codex_cli`): `get_chat_model()` returns an `AgentCLIChatModel` adapter backed by `provider.complete()`, so the analyzers' `.invoke()` / `.with_structured_output(schema).invoke()` calls work with no API key (structured output is produced by prompting for JSON, then Pydantic-validating). `chat_completion()` routes through `get_chat_model()` as well. `is_llm_available()` calls `provider.is_available()` instead of credential resolution.
+  - **CLI providers** (`claude_cli`, `gemini_cli`, `opencode_cli`): `get_chat_model()` returns an `AgentCLIChatModel` adapter backed by `provider.complete()`, so the analyzers' `.invoke()` / `.with_structured_output(schema).invoke()` calls work with no API key (structured output is produced by prompting for JSON, then Pydantic-validating). `chat_completion()` routes through `get_chat_model()` as well. `is_llm_available()` calls `provider.is_available()` instead of credential resolution.
 - **LLM analyzer base** ([llm_analyzer_base.py](../src/skillspector/nodes/llm_analyzer_base.py)): `LLMAnalyzerBase` provides per-file/per-chunk batching, token-budget-aware chunking, and a run loop for all LLM-based analyzers. `LLMMetaAnalyzer` extends it for filter/enrich (meta_analyzer node). Future semantic analyzers extend `LLMAnalyzerBase` for discovery mode.
 
 ---
diff --git a/src/skillspector/cli.py b/src/skillspector/cli.py
index 32560d70a..5d9071e6c 100644
--- a/src/skillspector/cli.py
+++ b/src/skillspector/cli.py
@@ -619,7 +619,7 @@ def scan(
         SKILLSPECTOR_PROVIDER  Active LLM provider: openai | anthropic |
                                anthropic_proxy | bedrock | nv_build |
                                nv_inference | ollama | azure_openai |
-                               openai_compatible | claude_cli | codex_cli |
+                               openai_compatible | claude_cli |
                                gemini_cli | opencode_cli. Defaults to the NVIDIA path
                                (nv_inference, falling back to nv_build in
                                OSS builds).
@@ -642,9 +642,10 @@ def scan(
         SKILLSPECTOR_COMPAT_API_KEY +
           SKILLSPECTOR_COMPAT_BASE_URL       for openai_compatible
 
-        ollama uses the local Ollama service. claude_cli, codex_cli,
+        ollama uses the local Ollama service. claude_cli,
         gemini_cli, and opencode_cli use their CLI's existing local
-        authentication session.
+        authentication session. codex_cli is registered but disabled because
+        its read-only sandbox permits host-file reads; use another provider.
     """
     if mcp_registry_compare is not None and not mcp_registry:
         err_console.print("[red]Error:[/red] --mcp-registry-compare requires --mcp-registry")
diff --git a/src/skillspector/providers/__init__.py b/src/skillspector/providers/__init__.py
index 754fc2c5a..23287a9c3 100644
--- a/src/skillspector/providers/__init__.py
+++ b/src/skillspector/providers/__init__.py
@@ -31,7 +31,7 @@
     azure_openai      → AzureOpenAIProvider          (Azure OpenAI Service)
     openai_compatible → OpenAICompatibleProvider     (Groq, Together AI, Mistral, etc.)
     claude_cli        → ClaudeCLIProvider            (local ``claude`` binary, no API key)
-    codex_cli         → CodexCLIProvider             (local ``codex`` binary, no API key)
+    codex_cli         → CodexCLIProvider             (registered but disabled: host-file reads)
     gemini_cli        → GeminiCLIProvider            (local ``gemini`` binary, no API key)
     opencode_cli      → OpencodeCLIProvider          (local ``opencode`` binary, no API key)
     antigravity_cli   → AntigravityCLIProvider       (local ``agy`` binary; registered
diff --git a/src/skillspector/providers/_agent_cli.py b/src/skillspector/providers/_agent_cli.py
index d284acba4..763c698b1 100644
--- a/src/skillspector/providers/_agent_cli.py
+++ b/src/skillspector/providers/_agent_cli.py
@@ -41,8 +41,8 @@
   of capability removal).
 
 The JSON output envelope (``claude -p --output-format json``) is parsed
-and the assistant text is returned.  ``codex exec --json`` produces
-JSONL events; the last assistant message is extracted.
+and the assistant text is returned. The Codex JSONL parser is retained for
+compatibility, but Codex inference is disabled before a subprocess is started.
 """
 
 from __future__ import annotations
@@ -276,6 +276,8 @@ def _parse_claude_output(raw: str) -> str:
 # ---------------------------------------------------------------------------
 
 
+# Registered but disabled. Re-enabling requires a pinned CLI version and a
+# verified policy preflight that denies every model-driven tool and host-file read.
 _CODEX_DISABLED_REASON = (
     "codex_cli is disabled: its read-only sandbox still permits commands to read "
     "host files, and SkillSpector has no verified deny-all-tools policy for Codex. "
diff --git a/src/skillspector/providers/codex_cli/__init__.py b/src/skillspector/providers/codex_cli/__init__.py
index f5f60c1aa..6495d702c 100644
--- a/src/skillspector/providers/codex_cli/__init__.py
+++ b/src/skillspector/providers/codex_cli/__init__.py
@@ -13,15 +13,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Codex CLI provider — uses the locally-installed ``codex`` binary.
+"""Codex CLI provider — registered but disabled.
 
-No API key required. Authentication is managed by the ``codex`` CLI's
-own session (``codex login``). Set ``SKILLSPECTOR_PROVIDER=codex_cli``
-to activate.
-
-NOTE: codex_cli support is implemented using the same hardened subprocess
-helper as claude_cli (``_agent_cli.run_agent_cli``).  See provider.py for
-sandbox flags and limitations.
+The read-only sandbox still permits model-driven host-file reads. Availability
+checks and inference therefore fail closed without starting Codex. Use an HTTP
+API provider or another supported CLI provider for LLM analysis.
 """
 
 from .provider import CodexCLIProvider
diff --git a/tests/integration/test_agent_cli_live.py b/tests/integration/test_agent_cli_live.py
index 8bf7ba533..976e773e9 100644
--- a/tests/integration/test_agent_cli_live.py
+++ b/tests/integration/test_agent_cli_live.py
@@ -17,7 +17,7 @@
 
 WHY THESE ARE OPTIONAL
 ----------------------
-These tests invoke the REAL local agent CLIs (``claude`` / ``codex`` /
+These tests invoke the REAL local agent CLIs (``claude`` /
 ``gemini``), so they are marked ``integration`` and are therefore EXCLUDED from
 the default test run — ``pyproject.toml`` sets ``addopts = -m 'not
 integration'``. A developer (at NVIDIA or anywhere) who does **not** have any of
@@ -28,7 +28,7 @@
 
 When you DO opt in with ``-m integration``, each case additionally SKIPS
 per-CLI when that binary is absent or unauthenticated. So if you only have
-``codex`` installed, the codex cases run and the claude/gemini cases skip
+``claude`` installed, the claude cases run and the gemini cases skip
 cleanly — a missing tool never fails the suite.
 
     # exercise whichever agent CLIs you happen to have installed + logged in:
@@ -41,6 +41,9 @@
      executed (the capability-stripped, fail-closed invocation; the flags that
      guarantee this are unit-tested in ``tests/unit/test_agent_cli.py``).
 
+``codex`` is excluded because its read-only sandbox permits host-file reads;
+its fail-closed behaviour is covered by unit tests.
+
 ``agy`` (Antigravity) is intentionally NOT covered: it is registered but
 DISABLED — its print mode renders to a TTY and returns nothing on a pipe, so it
 cannot be driven programmatically (see the note in
@@ -58,7 +61,7 @@
 
 #: Real ``stdin -> stdout`` agent CLIs this harness can drive. Add a new CLI here
 #: once it is wired into the ``_agent_cli`` registry and verified end-to-end.
-LIVE_CLIS = ["claude", "codex", "gemini"]
+LIVE_CLIS = ["claude", "gemini"]
 
 
 def _require(cli: str) -> None: