codex-implementer: timeout guard is a no-op under zsh (exit 127 before codex runs)

[sherySJ]

Summary

The codex-implementer agent's timeout guard is a no-op under zsh. The command dies with exit 127 before codex exec ever starts, so the advertised ten-minute cap silently never applies. Since zsh is the macOS default shell and the surrounding comment specifically targets macOS, this likely affects most users on the platform.

Location

agents/codex-implementer.md, section "How you run codex", step 2 (v4.0.0, lines 73-76):

T=$(command -v gtimeout || command -v timeout || true)
[ -z "$T" ] && echo "WARN: no timeout binary - codex runs uncapped (brew install coreutils to cap)"

${T:+$T 600} codex exec \

The flag-discipline table at line 94 documents this as "Ten-minute wall clock when timeout/gtimeout exists".

Cause

bash performs word splitting on the unquoted ${T:+$T 600} expansion, producing two arguments. zsh does not split unquoted parameter expansions, so the whole thing becomes a single word: a filename literally named /opt/homebrew/bin/gtimeout 600, which does not exist.

Reproduction

$ zsh -c 'T=$(command -v gtimeout || true); ${T:+$T 2} echo hello'
zsh:1: no such file or directory: /opt/homebrew/bin/gtimeout 2

$ bash -c 'T=$(command -v gtimeout || true); ${T:+$T 2} echo hello'
hello

Impact

Two failure modes, and the second is the concerning one:

1. On a machine with coreutils installed, the lane's first codex exec attempt fails outright with exit 127. Observed live on 2026-08-07: the agent caught the empty result and retried without the wrapper, so the task still completed, but the retry runs uncapped.
2. On a machine without coreutils, T is empty, the expansion vanishes, and codex runs uncapped. That path is intended and warned about, so it is fine.

The net effect is that the cap never actually applies under zsh either way, while the documentation says it does. A hung codex run has no wall-clock bound and never returns STATUS: timeout.

Suggested fix

Positional parameters expand correctly in both shells and handle the empty case cleanly:

T=$(command -v gtimeout || command -v timeout || true)
[ -z "$T" ] && echo "WARN: no timeout binary - codex runs uncapped (brew install coreutils to cap)"

if [ -n "$T" ]; then set -- "$T" 600; else set --; fi

"$@" codex exec \
  --model gpt-5.6-luna \
  -c model_reasoning_effort=max \
  ...

Verified four ways, bash and zsh, each with and without the binary present, all correct. Confirmed it actually caps:

$ zsh -c 'T=$(command -v gtimeout || true); if [ -n "$T" ]; then set -- "$T" 2; else set --; fi; "$@" sleep 10; echo "exit=$?"'
exit=124

An alternative is ${=T} to force splitting, but that is zsh-only and would break bash, so the positional-parameter form seems preferable for a cross-shell agent.

Environment

• Plugin fable-advisor@fable-advisor v4.0.0
• macOS (Darwin 27.0.0), Apple silicon, zsh as the default shell
• Codex CLI 0.146.0, coreutils installed via Homebrew (gtimeout at /opt/homebrew/bin/gtimeout)

Thanks for the plugin. The architect-as-orchestrator doctrine has been working well for us otherwise; this was the only defect that surfaced across a full day of use.

[JYeswak]

Confirming this on a second platform and on the current release — it survived the v4 → v5
rewrite and is still on main.

Expected vs observed

Expected, per the flag-discipline table: a ten-minute wall clock on the routine lane and thirty
minutes on the escalation lane whenever timeout/gtimeout exists.

Observed: under zsh the guard never applies. The command dies at exit 127 before codex exec
starts, because the expansion becomes a single filename containing a space.

Still present in v5.0.0 (and on main at commit 4d6cc62)

• agents/codex-implementer.md:80 — ${T:+$T 600} codex exec \
• agents/codex-implementer.md:98 — the flag-discipline row documenting the ten-minute clock
• agents/sol-implementer.md:80 — ${T:+$T 1800} codex exec \
• agents/sol-implementer.md:98 — the same row, thirty minutes

Reproduction

zsh  -c 'T=$(command -v gtimeout || command -v timeout || true); ${T:+$T 2} echo hello; echo "exit=$?"'
# → zsh:1: no such file or directory: /opt/homebrew/bin/gtimeout 2
# → exit=127

bash -c 'T=$(command -v gtimeout || command -v timeout || true); ${T:+$T 2} echo hello; echo "exit=$?"'
# → hello
# → exit=0

Environment

Independent of the original report: macOS Darwin 25.5.0, Apple silicon, zsh as the default
shell, coreutils installed (gtimeout at /opt/homebrew/bin/gtimeout), Codex CLI 0.152.1,
plugin v5.0.0. The original report was Darwin 27.0.0 / Codex 0.146.0 / v4.0.0 — so this is not
specific to either machine, and it is not a version that has since been fixed.

Your proposed fix verifies in all four branches

Running the positional-parameter form from the issue as written:

zsh,  gtimeout present  →  exit=124   (capped)
zsh,  T empty           →  runs, exit=0  (the intended uncapped path)
bash, gtimeout present  →  exit=124   (capped)
bash, T empty           →  runs, exit=0

One scope note, so a sweep does not over-reach

The adjacent expansion two lines down collapses under zsh in exactly the same way:

zsh:  printf "[%s]\n" ${EFFORT:+-c model_reasoning_effort=$EFFORT}
# → [-c model_reasoning_effort=max]      one word

bash: same
# → [-c]
# → [model_reasoning_effort=max]         two words

It is not a defect. -c is a short flag, so clap accepts the attached-value form and the
TOML parser tolerates the leading space. Verified by passing a deliberately invalid effort
through both forms and getting an identical HTTP 400 back, so the value reaches the model
either way.

The timeout case breaks only because there the collapsed word is a command name, and a
filename cannot carry an embedded space.

Why this matters

The failure is silent in the direction that costs the most: on a machine with coreutils the
first attempt fails at 127 and any retry runs uncapped, and on a machine without it the
expansion vanishes and the run is uncapped by design. Either way a hung codex exec has no
wall clock and the lane can never return STATUS: timeout, which is the one state the report
contract has for it.

Dedup

gh issue list --repo DannyMac180/fable-advisor --state all --search <term> for timeout,
zsh, word split and exit 127 each return this issue and nothing else — no duplicate, so
this is a confirmation here rather than a new filing.

Not asking for

Anything beyond the contract already documented in the flag-discipline table — the cap it
describes, actually applying under the platform's default shell.