@bakers-build/addon-codex 0.5.1-next.776 → 0.5.1-next.808

package/dist/src/index.d.ts

@@ -27,7 +27,7 @@ export declare class CodexAgent implements BbAgent {
     /** The launch flags a security mode owns (`docs/addons/codex.md`). */
     private securityFlags;
     private userMcpServers;
-    launchCommand(prompt: string, _run?: AgentRunIdentity): string;
+    launchCommand(prompt: string, _run?: AgentRunIdentity, workspacePath?: string): string;
     getRunLog(worktreePath: string, run?: AgentRunIdentity): Promise<string>;
     parseFootprint(log: string): AgentFootprint;
     /** Codex brings its own sandbox runner; a missing binary fails at launch as before. */

package/dist/src/index.js

@@ -1,3 +1,4 @@
+import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { readdir, readFile, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
@@ -127,7 +128,7 @@ export class CodexAgent {
         }
     }
     /** The launch flags a security mode owns (`docs/addons/codex.md`). */
-    securityFlags() {
+    securityFlags(workspacePath) {
         const { mode, sandbox, config } = this.security;
         if (mode === 'system')
             return [];
@@ -145,18 +146,45 @@ export class CodexAgent {
         ]);
         if (mode === 'custom')
             return pairs(Object.entries(config ?? {}));
+        const gitDirs = new Set();
+        for (const option of ['--git-dir', '--git-common-dir']) {
+            const git = spawnSync('git', ['-C', workspacePath, 'rev-parse', '--path-format=absolute', option], { encoding: 'utf8', env: { ...process.env, LC_ALL: 'C' } });
+            if (git.error)
+                throw git.error;
+            if (git.status !== 0) {
+                if (git.stderr.includes('not a git repository'))
+                    break;
+                throw new Error(`Cannot resolve Codex workspace Git directories: ${git.stderr.trim()}`);
+            }
+            gitDirs.add(git.stdout.replace(/\r?\n$/, ''));
+        }
+        const roots = sandbox.allow_write.map((dir) => `${JSON.stringify(dir.startsWith('~/') ? join(this.home, dir.slice(2)) : dir)} = true`);
+        // Filesystem overrides replace inherited entries, so retain workspace protections explicitly.
+        const filesystem = [
+            '":workspace_roots" = { ".git" = "read", ".agents" = "read", ".codex" = "read", ".aws" = "read" }',
+            ...[...gitDirs].flatMap((dir) => [
+                `${JSON.stringify(dir)} = "write"`,
+                // Unsandboxed Git later runs config/hooks code, or follows these redirects to it.
+                ...[
+                    'config',
+                    'config.worktree',
+                    'hooks',
+                    'commondir',
+                    'gitdir',
+                    'modules',
+                    'worktrees',
+                ].map((name) => `${JSON.stringify(join(dir, name))} = "read"`),
+            ]),
+        ];
+        const profile = `{ extends = ":workspace", filesystem = { ${filesystem.join(', ')} }, workspace_roots = { ${roots.join(', ')} }, network = { enabled = ${sandbox.network.length > 0} } }`;
         const flags = [
-            '--sandbox',
-            'workspace-write',
             '-a',
             'never',
-            ...pairs([
-                ['sandbox_workspace_write.network_access', sandbox.network.length > 0],
-            ]),
+            '-c',
+            'default_permissions="bakers"',
+            '-c',
+            `permissions.bakers=${profile}`,
         ];
-        for (const dir of sandbox.allow_write) {
-            flags.push('--add-dir', dir.startsWith('~/') ? join(this.home, dir.slice(2)) : dir);
-        }
         for (const id of this.userMcpServers()) {
             if (!Object.hasOwn(sandbox.mcp_servers, id)) {
                 flags.push(...pairs([[`mcp_servers.${id}.enabled`, false]]));
@@ -175,10 +203,10 @@ export class CodexAgent {
         }
         return codexMcpServerIds(toml);
     }
-    launchCommand(prompt, _run) {
+    launchCommand(prompt, _run, workspacePath = process.cwd()) {
         // Quote at assembly; a plain word has nothing for the shell to expand.
         const word = (t) => (/^[\w./=-]+$/.test(t) ? t : shellQuote(t));
-        const parts = ['codex', ...this.securityFlags().map(word)];
+        const parts = ['codex', ...this.securityFlags(workspacePath).map(word)];
         if (this.model !== undefined && !this.overrides.model) {
             parts.push('--model', shellQuote(this.model));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakers-build/addon-codex",
-  "version": "0.5.1-next.776",
+  "version": "0.5.1-next.808",
   "description": "bakers.build agent plugin for the Codex CLI.",
   "type": "module",
   "license": "MIT",
@@ -20,7 +20,7 @@
     "directory": "bakers-cli/addons/codex"
   },
   "peerDependencies": {
-    "@bakers-build/conductor": "^0.5.1-next.776",
-    "@bakers-build/core": "^0.5.1-next.776"
+    "@bakers-build/conductor": "^0.5.1-next.808",
+    "@bakers-build/core": "^0.5.1-next.808"
   }
 }