test: cover the codex effort values that killed agents at config load

Two regressions from the 2026-08-17 incident, where a task dispatched at
`effort:max` spawned `codex -c model_reasoning_effort=max` and codex rejected
it while loading its config — before the prompt was read, so all three retries
died identically.

- agentCliSpawning: assert the CLI builder clamps max/ultra to xhigh for codex.
  The TUI builder already had this assertion; the CLI builder is the one that
  actually shipped the bad argv.
- agentErrorAnalysis: classify the pathless "Error loading config.toml: unknown
  variant `max`" wording codex emits for a `-c` override rejection (the existing
  test used the file:line:col form), and assert the failure blocks on the first
  attempt instead of burning all three retries.

Author: atomantic

server/services/agentCliSpawning.test.js

@@ -394,6 +394,20 @@ describe('buildCliSpawnConfig', () => {
       expect(config.args).toContain('model_reasoning_effort=xhigh');
     });
 
+    // Regression for the 2026-08-17 incident: codex's config enum stops at
+    // `xhigh`, so a task dispatched at `effort:max` used to spawn
+    // `codex -c model_reasoning_effort=max`, which codex rejects while LOADING
+    // its config — before the prompt is read, so every retry died identically.
+    // The TUI builder has the twin of this assertion; the CLI builder is the one
+    // that actually shipped the bad argv.
+    it('clamps max/ultra down to xhigh for codex rather than emitting a value it rejects', () => {
+      for (const effort of ['max', 'ultra']) {
+        const config = buildCliSpawnConfig({ id: 'codex', command: 'codex' }, 'gpt-5.4', {}, { effort });
+        expect(config.args).toContain('model_reasoning_effort=xhigh');
+        expect(config.args.join(' ')).not.toContain(`model_reasoning_effort=${effort}`);
+      }
+    });
+
     it('adds --effort for claude', () => {
       const config = buildCliSpawnConfig({ id: 'claude-code', command: 'claude' }, 'claude-opus-4-8', {}, { effort: 'high' });
       expect(config.args[config.args.indexOf('--effort') + 1]).toBe('high');

server/services/agentErrorAnalysis.test.js

@@ -129,6 +129,27 @@ describe('analyzeAgentFailure — ERROR_PATTERNS classification', () => {
     expect(analysis.message).not.toContain('/home/x/');
   });
 
+  // Same incident, the OTHER source: PortOS's own `-c model_reasoning_effort=max`
+  // override. Codex reports an override rejection with the same "Error loading
+  // config.toml" lead but NO file:line:col prefix, so this wording is what the
+  // three failing runs on 2026-08-17 actually recorded — verified by running
+  // `codex exec -c model_reasoning_effort=max -`. Classifying it (not falling
+  // through to `unknown`) is what keeps it a Tier 1 config fix instead of an
+  // escalated investigation. `resolveCliEffort` is what stops PortOS emitting
+  // the bad value in the first place (server/lib/providerModels.js).
+  it('classifies a codex -c override rejection (no file path in the message)', () => {
+    const line = 'Error loading config.toml: unknown variant `max`, expected one of `none`, `minimal`, `low`, `medium`, `high`, `xhigh`\n    in `model_reasoning_effort`';
+    const analysis = analyzeAgentFailure(withLead(line), { id: 't' }, 'gpt-5.6-sol');
+    expect(analysis.category).toBe('cli-config-invalid');
+    expect(analysis.rejectedConfigKey).toBe('model_reasoning_effort');
+    expect(analysis.rejectedConfigValue).toBe('max');
+    // A CLI that dies at config load dies identically every time — the run must
+    // block on the FIRST failure rather than burn all three retries on it.
+    const decision = resolveFailedTaskDecision({ id: 't', metadata: {} }, analysis);
+    expect(decision.status).toBe('blocked');
+    expect(decision.metadataUpdates.blockedCategory).toBe('cli-config-invalid');
+  });
+
   it('classifies a config file that fails to load at all', () => {
     const analysis = analyzeAgentFailure(withLead('Error loading config.toml: expected a value after the equals sign'), { id: 't' }, 'x');
     expect(analysis.category).toBe('cli-config-invalid');