@ai-sdk/harness-codex 1.0.79 → 1.0.81

package/dist/index.js

@@ -12,8 +12,10 @@ import {
   createBridgeStartupError,
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
+  getRestrictedSandboxSession,
   markBridgeStarting,
   maskSandboxCredentials,
+  resolveSandboxDefaultWorkingDirectory,
   resolveSandboxHomeDir,
   SandboxChannel,
   shellQuote,
@@ -224,7 +226,7 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 var CLI_SHIM_FILENAME = "harness-tool.mjs";
 
 // src/version.ts
-var VERSION = true ? "1.0.79" : "0.0.0-test";
+var VERSION = true ? "1.0.81" : "0.0.0-test";
 
 // src/codex-harness.ts
 var DEFAULT_CODEX_MODEL = "gpt-5.5";
@@ -275,10 +277,27 @@ function createCodex(settings = {}) {
         });
       }
       const sandboxSession = startOpts.sandboxSession;
+      const toolSafeSandboxSession = getRestrictedSandboxSession(sandboxSession);
+      const sandboxId = "id" in sandboxSession ? sandboxSession.id : void 0;
+      validateBasicSandboxSettings({
+        sandboxSession,
+        port: settings.port,
+        portEndpoint: settings.portEndpoint
+      });
+      if (settings.mintBridgeToken != null && sandboxId == null) {
+        throw new HarnessCapabilityUnsupportedError({
+          harnessId: "codex",
+          message: "The codex harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id."
+        });
+      }
+      const defaultWorkingDirectory = await resolveSandboxDefaultWorkingDirectory({
+        sandboxSession,
+        abortSignal: startOpts.abortSignal
+      });
       const authenticationMode = resolveCodexAuthenticationMode(settings.auth);
       const resolvedAuthEnvironment = resolveCodexEnv(settings.auth);
       let sandboxAuthEnvironment = resolvedAuthEnvironment;
-      if (sandboxSession.addRequestTransformations != null) {
+      if ("addRequestTransformations" in sandboxSession && sandboxSession.addRequestTransformations != null) {
         const requestTransformations = createCodexRequestTransformations(
           resolvedAuthEnvironment,
           authenticationMode
@@ -298,10 +317,8 @@ function createCodex(settings = {}) {
       } else {
         warnCredentialBrokeringUnavailable();
       }
-      const session = sandboxSession.restricted();
-      const sandboxId = sandboxSession.id;
       const bootstrapDir = path.posix.resolve(
-        sandboxSession.defaultWorkingDirectory,
+        defaultWorkingDirectory,
         CODEX_BOOTSTRAP_DIR
       );
       const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
@@ -312,7 +329,7 @@ function createCodex(settings = {}) {
       const resumeThreadIdString = typeof resumeThreadId === "string" && resumeThreadId.length > 0 ? resumeThreadId : void 0;
       const coords = resumeData?.bridge;
       const workDir = startOpts.sessionWorkDir;
-      const sessionDataDir = `${sandboxSession.defaultWorkingDirectory}/.agent-runs/${startOpts.sessionId}`;
+      const sessionDataDir = `${defaultWorkingDirectory}/.agent-runs/${startOpts.sessionId}`;
       const bridgeStateDir = `${sessionDataDir}/bridge`;
       const cliShimDir = `${sessionDataDir}/codex`;
       const cliShimPath = `${cliShimDir}/${CLI_SHIM_FILENAME}`;
@@ -330,9 +347,10 @@ function createCodex(settings = {}) {
       });
       if (coords) {
         try {
-          const endpoint2 = await sandboxSession.getPortEndpoint({
-            port: coords.port,
-            protocol: "ws"
+          const endpoint2 = await resolveBridgeEndpoint({
+            sandboxSession,
+            override: settings.portEndpoint,
+            port: coords.port
           });
           const attachEndpoint = withBridgeToken({
             endpoint: endpoint2,
@@ -373,7 +391,7 @@ function createCodex(settings = {}) {
       let respawnStrategy = isResume ? "rerun" : void 0;
       if (coords && isContinue) {
         const logRaw = await Promise.resolve(
-          session.readTextFile({
+          toolSafeSandboxSession.readTextFile({
             path: `${bridgeStateDir}/event-log.ndjson`,
             abortSignal: startOpts.abortSignal
           })
@@ -382,10 +400,13 @@ function createCodex(settings = {}) {
           respawnStrategy = "replay";
         }
       }
-      const port = resolveBridgePort(sandboxSession, settings.port);
+      const port = resolveBridgePort({
+        sandboxSession,
+        override: settings.port
+      });
       const token = settings.mintBridgeToken == null ? randomBytes(32).toString("hex") : settings.mintBridgeToken(sandboxId);
       const codexSkillSetup = startOpts.skills && startOpts.skills.length > 0 ? await writeCodexSkills({
-        sandbox: session,
+        sandbox: toolSafeSandboxSession,
         skills: startOpts.skills,
         abortSignal: startOpts.abortSignal
       }) : void 0;
@@ -401,18 +422,18 @@ function createCodex(settings = {}) {
         ...respawnStrategy === "replay" ? { BRIDGE_REPLAY_FROM_DISK: "1" } : {}
       };
       if (respawnStrategy === void 0) {
-        await session.run({
+        await toolSafeSandboxSession.run({
           command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,
           abortSignal: startOpts.abortSignal
         });
       }
       await markBridgeStarting({
-        sandbox: session,
+        sandbox: toolSafeSandboxSession,
         bridgeStateDir,
         bridgeType: "codex",
         abortSignal: startOpts.abortSignal
       });
-      const proc = await session.spawn({
+      const proc = await toolSafeSandboxSession.spawn({
         command: `node ${shellQuote(`${bootstrapDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)} --cli-shim-dir ${shellQuote(cliShimDir)}`,
         env,
         abortSignal: startOpts.abortSignal
@@ -426,7 +447,7 @@ function createCodex(settings = {}) {
       });
       const { port: boundPort } = await waitForBridgeReady({
         proc,
-        sandbox: session,
+        sandbox: toolSafeSandboxSession,
         bridgeStateDir,
         bridgeType: "codex",
         timeoutMs,
@@ -447,9 +468,10 @@ function createCodex(settings = {}) {
         })
       });
       void drainBridgeProcessStream(proc.stdout);
-      const endpoint = await sandboxSession.getPortEndpoint({
-        port: boundPort,
-        protocol: "ws"
+      const endpoint = await resolveBridgeEndpoint({
+        sandboxSession,
+        override: settings.portEndpoint,
+        port: boundPort
       });
       const bridgeEndpoint = withBridgeToken({ endpoint, token });
       const channel = new SandboxChannel({
@@ -488,14 +510,52 @@ function createCodex(settings = {}) {
     }
   };
 }
-function resolveBridgePort(sandboxSession, override) {
+function resolveBridgePort({
+  sandboxSession,
+  override
+}) {
   if (override !== void 0) return override;
-  if (sandboxSession.ports.length > 0) return sandboxSession.ports[0];
+  if ("ports" in sandboxSession && sandboxSession.ports.length > 0) {
+    return sandboxSession.ports[0];
+  }
   throw new HarnessCapabilityUnsupportedError({
     harnessId: "codex",
     message: "The codex harness needs a TCP port exposed by the sandbox. Create the sandbox with `ports: [<port>]` or pass `createCodex({ port })`."
   });
 }
+function validateBasicSandboxSettings({
+  sandboxSession,
+  port,
+  portEndpoint
+}) {
+  if ("getPortEndpoint" in sandboxSession) return;
+  if (port == null) {
+    throw new HarnessCapabilityUnsupportedError({
+      harnessId: "codex",
+      message: "The codex harness requires an explicit `port` when using a basic sandbox session."
+    });
+  }
+  if (portEndpoint == null) {
+    throw new HarnessCapabilityUnsupportedError({
+      harnessId: "codex",
+      message: "The codex harness requires an explicit `portEndpoint` when using a basic sandbox session."
+    });
+  }
+}
+async function resolveBridgeEndpoint({
+  sandboxSession,
+  override,
+  port
+}) {
+  if (override != null) return override;
+  if ("getPortEndpoint" in sandboxSession) {
+    return sandboxSession.getPortEndpoint({ port, protocol: "ws" });
+  }
+  throw new HarnessCapabilityUnsupportedError({
+    harnessId: "codex",
+    message: "The codex harness requires an explicit `portEndpoint` when using a basic sandbox session."
+  });
+}
 async function writeCodexSkills({
   sandbox,
   skills,
@@ -683,9 +743,6 @@ function createSession({
           reason: input.reason
         });
       },
-      submitUserMessage: async (text) => {
-        channel.send({ type: "user-message", text });
-      },
       done
     };
     return {
@@ -822,7 +879,7 @@ function createSession({
             port: bridgePort,
             token: bridgeToken,
             lastSeenEventId,
-            sandboxId
+            ...sandboxId == null ? {} : { sandboxId }
           }
         }
       };
@@ -937,7 +994,7 @@ function createSession({
             port: bridgePort,
             token: bridgeToken,
             lastSeenEventId,
-            sandboxId
+            ...sandboxId == null ? {} : { sandboxId }
           }
         }
       };