fix(codex): resolve probe helper paths when sourced from zsh

[bezdekt]

Why (in your own words)

On macOS, Claude Code's tool shell is zsh, and the review skills source bin/gstack-codex-probe into it. zsh leaves BASH_SOURCE empty, so every "${BASH_SOURCE[0]%/*}/…" path in the probe collapses to "/…". Model selection then dies with Module not found "/../scripts/resolve-codex-generation-model.ts", prints CODEX_MODEL: invalid, and reports CODEX_MODE: model_unusable. Every /plan-eng-review (and other outside-voice) run skips Codex, and the message points at the model config, which was fine. The three gstack-state-root.sh lookups fail silently the same way. This adds a _gstack_codex_bin_dir helper that resolves the probe's own directory in bash (BASH_SOURCE) and zsh ($functions_source), with a ~/.claude/skills/gstack/bin fallback, and uses it at all five sites.

Live evidence

Before, the /plan-eng-review preflight run from Claude Code's zsh tool shell on macOS 26:

error: Module not found "/../scripts/resolve-codex-generation-model.ts"
CODEX_MODEL: invalid — Codex outside review unavailable; missing coverage. No Codex call was made. Fix the model choice above; gstack never substitutes its default for it.
MODEL_UNUSABLE
CODEX_MODE: model_unusable

Root cause, shown directly:

$ zsh -c 'source ~/.claude/skills/gstack/bin/gstack-codex-probe; echo "[${BASH_SOURCE[0]}]"'
[]

After, the same preflight from the same zsh shell:

CODEX_MODEL: gpt-6.1-sol (exec; source: /Users/…/.codex/config.toml model)
MODEL_OK (cached)
CODEX_MODE: ready

Then the skill's exact codex exec block from zsh with a trivial prompt returned exit=0 and the expected Recommendation: line.

The helper resolves the real directory, not the fallback, in both shells (probe copied to an unrelated dir):

zsh  → /private/tmp/…/probe-copy
bash → /private/tmp/…/probe-copy

New test selection works when the probe is sourced from zsh: on the old probe it fails with the exact production error (Module not found "/../scripts/resolve-codex-generation-model.ts"); with the fix it passes. The fixture HOME has no gstack install, so the fallback path cannot pass it.

Scope

• Changed: bin/gstack-codex-probe (new _gstack_codex_bin_dir, 5 call sites), test/codex-model-probe.test.ts (+1 zsh test, skipped when zsh is absent).
• Verified live by: the preflight and a real codex exec from Claude Code's zsh tool shell (macOS 26, zsh 5.9, bun 1.3.13); bun test test/codex-model-probe.test.ts test/codex-hardening.test.ts → 91 pass, 3 fail. The 3 failures are the B1 Linux-sandbox cases, and they fail identically on unpatched main on macOS. bun run typecheck:test → "none new".
• Did NOT test: Linux, Windows/Git Bash, zsh older than 5.4 ($functions_source needs 5.4+; older zsh falls back to ~/.claude/skills/gstack/bin), or the full bun run test suite.

Liveness proof (required for external contributors)

TODO (@bezdekt): attach the live GSTACK PR screenshot before marking ready. This draft was prepared by Claude Code on my behalf.

Checklist

• Liveness screenshot attached (GSTACK PR typed live into a real surface) or PR author is @garrytan (owner exemption)
• This is not a generated-file-only diff (I edited the source/template and regenerated)
• No ETHOS.md edits, and no changes to voice / founder perspective / YC references
• New public command / external service / host adapter has an accepted issue linked (or N/A)
• Linked issue or reproduction: # (reproduction above)

🤖 Generated with Claude Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[capy-ai]

Thanks for this. The Oct 6 fix wave rewrote the fix on branch garrytan/fix-wave-oct6, using your diagnosis, and credits you with a Co-authored-by trailer: sourced helpers now locate themselves under zsh. It also fixes the bash-only ${!name} lookup in the auth probe, which broke custom-provider keys under zsh (f0531a2). More review follow-ups are landing on the same branch. This PR will be closed when the wave PR merges, with a link to it.

[capy-ai]

Thanks for this. The fix landed in v1.91.32.0 via #3057, which rewrote it from your diagnosis and credits you with a Co-authored-by trailer on the commit. Closing in favor of #3057.