@bakers-build/addon-codex 0.4.1-next.513 → 0.5.0

package/dist/src/index.d.ts

@@ -1,4 +1,4 @@
-import { type AgentFootprint, type AgentPlugin, type AgentRunIdentity, type BbAgent, type RunEnvPolicy, type SecurityOptions } from '@bakers-build/conductor/contract';
+import { type AgentFootprint, type AgentPlugin, type AgentRunIdentity, type BbAgent, type RunEnvPolicy, type SandboxHost, type SandboxPreflight, type SecurityOptions } from '@bakers-build/conductor/contract';
 export { parseCodexTranscript } from './footprint.js';
 export interface CodexAgentOptions extends SecurityOptions {
     model?: string;
@@ -30,6 +30,8 @@ export declare class CodexAgent implements BbAgent {
     launchCommand(prompt: string, _run?: AgentRunIdentity): string;
     getRunLog(worktreePath: string, run?: AgentRunIdentity): Promise<string>;
     parseFootprint(log: string): AgentFootprint;
+    /** Codex brings its own sandbox runner; a missing binary fails at launch as before. */
+    sandboxPreflight(host?: SandboxHost): Promise<SandboxPreflight>;
 }
 /** Config-facing factory: `codexAgent({ model: 'gpt-5' })`. */
 export declare function codexAgent(options?: CodexAgentOptions): AgentPlugin;

package/dist/src/index.js

@@ -2,7 +2,7 @@ import { readFileSync } from 'node:fs';
 import { readdir, readFile, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { resolveAgentCliOptions, resolveSecurityOptions, } from '@bakers-build/conductor/contract';
+import { lastLine, resolveAgentCliOptions, resolveSecurityOptions, systemSandboxHost, } from '@bakers-build/conductor/contract';
 import { shellQuote } from '@bakers-build/core';
 import { parseCodexTranscript } from './footprint.js';
 export { parseCodexTranscript } from './footprint.js';
@@ -259,6 +259,23 @@ export class CodexAgent {
     parseFootprint(log) {
         return parseCodexTranscript(log);
     }
+    /** Codex brings its own sandbox runner; a missing binary fails at launch as before. */
+    async sandboxPreflight(host = systemSandboxHost()) {
+        if (this.security.mode !== 'sandbox' || !host.onPath('codex')) {
+            return { ok: true };
+        }
+        const probe = await host.run('codex', ['sandbox', 'true']);
+        // A release without this probe form is not proof the sandbox fails; launch decides.
+        return probe.ok || /unrecognized subcommand/.test(probe.stderr)
+            ? { ok: true }
+            : {
+                ok: false,
+                cause: `codex sandbox cannot start: ${lastLine(probe.stderr)}`,
+                fix: host.platform === 'linux'
+                    ? 'allow unprivileged user namespaces on this host, or run the conductor where they are allowed'
+                    : 'make `codex sandbox true` succeed on this host',
+            };
+    }
 }
 /** Config-facing factory: `codexAgent({ model: 'gpt-5' })`. */
 export function codexAgent(options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakers-build/addon-codex",
-  "version": "0.4.1-next.513",
+  "version": "0.5.0",
   "description": "bakers.build agent plugin for the Codex CLI.",
   "type": "module",
   "license": "MIT",
@@ -20,7 +20,7 @@
     "directory": "bakers-cli/addons/codex"
   },
   "peerDependencies": {
-    "@bakers-build/conductor": "^0.4.1-next.513",
-    "@bakers-build/core": "^0.4.1-next.513"
+    "@bakers-build/conductor": "^0.5.0",
+    "@bakers-build/core": "^0.5.0"
   }
 }