From d9c191ec39a7084b07128833fef95f1e41da8e9e Mon Sep 17 00:00:00 2001 From: CyberSecurityUP Date: Fri, 10 Jul 2026 16:37:00 -0300 Subject: [PATCH] fix(cli): codex exec exit-1 no longer discards a valid recon/agent result MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `codex exec` in --dangerously-bypass-approvals-and-sandbox mode exits non-zero when a tool/command it ran internally (curl/nmap/etc.) returned non-zero — even though it produced a valid final answer. chat_cli treated any non-zero exit as a hard failure and dropped the output ("recon round 1 failed ... exit 1"). Now, on non-zero exit WITH usable stdout and no auth/rate/quota keyword, we use the output; only genuine auth/rate/quota errors (or empty output) fail hard. --- neurosploit-rs/crates/harness/src/models.rs | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/neurosploit-rs/crates/harness/src/models.rs b/neurosploit-rs/crates/harness/src/models.rs index f4edc9b..87e5da7 100644 --- a/neurosploit-rs/crates/harness/src/models.rs +++ b/neurosploit-rs/crates/harness/src/models.rs @@ -245,6 +245,19 @@ impl ChatClient { } else { "no output".to_string() }; + // Agentic CLIs (esp. `codex exec` in bypass-sandbox mode) exit + // non-zero when a tool/command they ran internally returned non-zero + // (e.g. a curl/nmap that failed) — even though they produced a valid + // final answer. Treat that as success and use the output; only fail + // hard on a genuine auth/rate/quota error or when there's no output. + let low = format!("{stdout}\n{stderr}").to_lowercase(); + let hard = ["not logged in", "please log in", "please login", "run /login", + "unauthorized", "not authenticated", "invalid api key", "no api key", + "rate limit", "429", "quota", "credit balance", "usage limit"] + .iter().any(|k| low.contains(k)); + if !stdout.is_empty() && !hard { + return Ok(stdout); + } return Err(anyhow!( "{} subscription CLI exit {}: {}", bin,