@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/src/hosts/codex-process.ts

@@ -0,0 +1,202 @@
+import {
+  awaitHostProcess,
+  MAX_EVENT_BYTES,
+  HostProcessInterruption,
+} from "./process-lifecycle";
+import {
+  captureBoundedBytes,
+  captureBoundedText,
+  terminateOwnedProcessGroup,
+} from "../process-lifecycle";
+import { HostExecutionFailure, type HostResult } from "../evaluation/types";
+import {
+  HostProcessDiagnostics,
+  type HostDiagnostics,
+} from "../host-diagnostics";
+
+type Phase = NonNullable<HostResult["processFailure"]>["phase"];
+type Result = {
+  code: number;
+  out: string;
+  stderr: Uint8Array;
+  stderrTruncated: boolean;
+  signal: string | null;
+  durationMs: number;
+};
+
+export function codexFailureMessage(result: HostResult): string | undefined {
+  const failure = result.processFailure;
+  if (!failure) return undefined;
+  const labels = {
+    "isolation-preflight": "Codex isolation preflight",
+    "executable-preflight": "Codex executable preflight",
+    execution: "Codex run",
+  };
+  if (!Object.hasOwn(labels, failure.phase)) return undefined;
+  return `${labels[failure.phase]} ${failureSuffix(failure)}`;
+}
+
+function validTimeout(timeoutMs: number): boolean {
+  return (
+    Number.isSafeInteger(timeoutMs) && timeoutMs > 0 && timeoutMs <= 30 * 60_000
+  );
+}
+
+function failureSuffix(
+  failure: NonNullable<HostResult["processFailure"]>,
+): string {
+  if (failure.reason === "timeout" && validTimeout(failure.timeoutMs))
+    return `timed out after ${failure.timeoutMs / 1000} s`;
+  return failure.reason === "cancelled" ? "cancelled" : "failed";
+}
+
+export class CodexProcessFailure extends HostExecutionFailure {
+  constructor(
+    phase: Phase,
+    process: Result,
+    reason: NonNullable<HostResult["processFailure"]>["reason"] = "exit",
+    timeoutMs = 60_000,
+  ) {
+    const failure = { phase, reason, timeoutMs };
+    const result: HostResult = {
+      finalMessage: null,
+      complete: false,
+      executionFailed: true,
+      actualCondition: "passive",
+      processFailure: failure,
+      artifacts: [
+        {
+          id: "codex.process",
+          bytes: Buffer.from(
+            JSON.stringify({
+              ...failure,
+              code: process.code,
+              signal: process.signal,
+              durationMs: process.durationMs,
+              stderrTruncated: process.stderrTruncated,
+            }),
+          ),
+        },
+        { id: "codex.stderr", bytes: process.stderr },
+      ],
+    };
+    super(codexFailureMessage(result), result);
+  }
+}
+
+interface CodexProcessOptions {
+  diagnostics?: HostDiagnostics;
+  argv: string[];
+  cwd: string;
+  env: Record<string, string>;
+  input?: string;
+  timeoutMs: number;
+  signal?: AbortSignal;
+  phase?: Phase;
+}
+
+async function writeCodexInput(
+  proc: Bun.Subprocess,
+  input?: string,
+): Promise<void> {
+  if (input === undefined) return;
+  if (!proc.stdin || typeof proc.stdin === "number")
+    throw new Error("Codex input pipe unavailable");
+  await proc.stdin.write(input);
+  await proc.stdin.end();
+}
+
+function spawnCodexProcess(
+  options: CodexProcessOptions,
+  capture: HostProcessDiagnostics,
+) {
+  try {
+    return Bun.spawn(options.argv, {
+      cwd: options.cwd,
+      env: options.env,
+      detached: process.platform !== "win32",
+      stdin: options.input === undefined ? "ignore" : "pipe",
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+  } catch (cause) {
+    capture.recordUnstarted();
+    throw cause;
+  }
+}
+
+function processPhase(options: CodexProcessOptions): Phase {
+  return options.phase ?? "execution";
+}
+
+function requireCodexProcess(options: CodexProcessOptions): void {
+  if (options.signal?.aborted) throw new Error("Codex run cancelled");
+}
+
+function codexCompletion(
+  proc: ReturnType<typeof spawnCodexProcess>,
+  options: CodexProcessOptions,
+  capture: HostProcessDiagnostics,
+) {
+  const started = performance.now();
+  const stdout = captureBoundedText(proc.stdout, {
+    limit: MAX_EVENT_BYTES,
+    overflow: "reject",
+    exceeded: () => new Error("Codex event stream exceeds the size limit"),
+    observe: (bytes) => {
+      capture.stdout.add(bytes);
+    },
+  });
+  const stderr = captureBoundedBytes(proc.stderr, {
+    limit: 64 * 1024,
+    overflow: "truncate",
+    cancelOnError: true,
+    observe: (bytes) => {
+      capture.stderr.add(bytes);
+    },
+  });
+  const input = writeCodexInput(proc, options.input);
+  const completed = Promise.all([stdout, proc.exited, stderr, input]).then(
+    ([out, code, err]) => ({
+      out,
+      code,
+      stderr: err.bytes,
+      stderrTruncated: err.truncated,
+      signal: proc.signalCode ?? null,
+      durationMs: performance.now() - started,
+    }),
+  );
+  return { completed, drains: [stdout, stderr, input] };
+}
+
+export async function runCodexProcess(
+  options: CodexProcessOptions,
+): Promise<Result> {
+  requireCodexProcess(options);
+  const capture = new HostProcessDiagnostics(options.diagnostics);
+  const proc = spawnCodexProcess(options, capture);
+  const { completed, drains } = codexCompletion(proc, options, capture);
+  try {
+    const result = await awaitHostProcess(proc, completed, {
+      ...options,
+      host: "Codex",
+      stop: terminateOwnedProcessGroup,
+    });
+    await capture.record(proc);
+    return result;
+  } catch (cause) {
+    if (!(cause instanceof HostProcessInterruption)) {
+      await Promise.allSettled(drains);
+      await capture.record(proc, "error");
+      throw cause;
+    }
+    const result = await completed;
+    await capture.record(proc, cause.reason);
+    throw new CodexProcessFailure(
+      processPhase(options),
+      result,
+      cause.reason,
+      options.timeoutMs,
+    );
+  }
+}

package/src/hosts/codex-profile.ts

@@ -1,7 +1,29 @@
-import { isAbsolute } from "node:path";
+import { isAbsolute, join, sep } from "node:path";
+import { insideRuntimeRoot, isRuntimeHomeRoot } from "../runtime/paths";
+import { workspaceBoundaryException } from "../fixtures/workspace-state";
+import {
+  nativeStatePath,
+  nativeStateProtectedRoots,
+} from "../native-transcript-state";
+
+const LINUX_MINIMAL_READ_ROOTS = [
+  "/bin",
+  "/sbin",
+  "/usr",
+  "/etc",
+  "/lib",
+  "/lib64",
+  "/nix/store",
+  "/run/current-system/sw",
+];
 
 function toml(value: string): string {
-  if (/[\x00-\x1f\x7f]/.test(value))
+  if (
+    Array.from(value).some(
+      (character) =>
+        character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f,
+    )
+  )
     throw new Error("Codex profile value contains a control character");
   return JSON.stringify(value);
 }
@@ -15,38 +37,36 @@ export function codexPermissionProfile(options: {
   executableReadRoots: string[];
   pluginReadRoot?: string;
   protectedRoots: string[];
+  commandEnvironment?: Record<string, string>;
+  runtimeReadRoots?: string[];
+  nativeReadRoots?: string[];
+  nativeWriteRoots?: string[];
+  runtimeWriteRoot?: string;
+  localHttp?: boolean;
 }): string {
   if (!/^[a-z][a-z0-9_]*$/.test(options.id))
     throw new Error("invalid Codex permission profile ID");
-  if (
-    !isAbsolute(options.workspace) ||
-    !isAbsolute(options.commandHome) ||
-    !isAbsolute(options.commandTemp) ||
-    !options.executableReadRoots.length ||
-    options.executableReadRoots.some(
-      (path) => !isAbsolute(path) || path === "/",
-    ) ||
-    (options.pluginReadRoot !== undefined &&
-      (!isAbsolute(options.pluginReadRoot) ||
-        options.pluginReadRoot === "/")) ||
-    !options.protectedRoots.length ||
-    options.protectedRoots.some((root) => !isAbsolute(root))
-  )
+  if (!validProfilePaths(options))
     throw new Error("Codex profile paths must be absolute and protected");
   const name = options.id;
   return [
     `default_permissions = ${toml(name)}`,
     'approval_policy = "never"',
     "allow_login_shell = false",
+    ...codexFeatureLines(options.localHttp),
     "",
     "[shell_environment_policy]",
     'inherit = "none"',
     "ignore_default_excludes = false",
     "",
     "[shell_environment_policy.set]",
-    'PATH = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"',
+    ...commandEnvironmentLines(
+      options.commandEnvironment,
+      options.executableReadRoots,
+    ),
     `HOME = ${toml(options.commandHome)}`,
     `TMPDIR = ${toml(options.commandTemp)}`,
+    `TMPPREFIX = ${toml(join(options.commandTemp, sep))}`,
     "",
     `[permissions.${name}]`,
     'extends = ":workspace"',
@@ -54,25 +74,234 @@ export function codexPermissionProfile(options: {
     `[permissions.${name}.filesystem]`,
     '":root" = "deny"',
     '":minimal" = "read"',
-    '":tmpdir" = "deny"',
-    '":slash_tmp" = "deny"',
-    ...[...new Set(options.protectedRoots)]
+    ...(process.platform === "linux"
+      ? []
+      : ['":tmpdir" = "deny"', '":slash_tmp" = "deny"']),
+    ...minimalProtectedRoots(profileProtectedRoots(options))
       .sort()
       .map((root) => `${toml(root)} = "deny"`),
-    ...[...new Set(options.executableReadRoots)]
-      .sort()
-      .map((path) => `${toml(path)} = "read"`),
-    ...(options.pluginReadRoot
-      ? [`${toml(options.pluginReadRoot)} = "read"`]
-      : []),
+    ...readRootLines(options),
+    ...(options.nativeWriteRoots ?? []).map(
+      (root) => `${toml(root)} = "write"`,
+    ),
     `${toml(options.commandHome)} = "write"`,
     `${toml(options.commandTemp)} = "write"`,
+    ...optionalRootLines(options.runtimeWriteRoot, "write"),
+    // Override Codex's metadata carveout only for this isolated fixture.
+    `${toml(join(options.workspace, ".git"))} = "write"`,
     "",
-    `[permissions.${name}.filesystem.\":workspace_roots\"]`,
+    `[permissions.${name}.filesystem.":workspace_roots"]`,
     '"." = "write"',
     "",
     `[permissions.${name}.network]`,
-    "enabled = false",
+    ...networkProfile(options.localHttp),
     "",
   ].join("\n");
 }
+
+function codexFeatureLines(localHttp: boolean | undefined): string[] {
+  return [
+    "[features]",
+    "hooks = false",
+    ...(localHttp ? ["network_proxy = true"] : []),
+  ];
+}
+
+function networkProfile(localHttp: boolean | undefined): string[] {
+  if (!localHttp) return ["enabled = false"];
+  return [
+    "enabled = true",
+    "allow_local_binding = true",
+    "allow_upstream_proxy = false",
+    'domains = { "localhost" = "allow", "127.0.0.1" = "allow", "::1" = "allow" }',
+  ];
+}
+
+function profileProtectedRoots(
+  options: Parameters<typeof codexPermissionProfile>[0],
+): string[] {
+  const readRoots = profileReadRoots(options);
+  const trustedRoots = [
+    ...readRoots,
+    ...(options.nativeWriteRoots ?? []),
+    ...(options.runtimeWriteRoot ? [options.runtimeWriteRoot] : []),
+  ];
+  const baselines = [
+    ...LINUX_MINIMAL_READ_ROOTS,
+    ...readRoots,
+    ...(options.nativeWriteRoots ?? []),
+    options.workspace,
+    options.commandHome,
+    options.commandTemp,
+    ...(options.runtimeWriteRoot ? [options.runtimeWriteRoot] : []),
+  ];
+  return options.protectedRoots.filter(
+    (root) =>
+      (!implicitLinuxHomeBoundary(root, readRoots, baselines) ||
+        process.platform !== "linux") &&
+      !implicitNativeBoundary(root, trustedRoots, baselines) &&
+      !implicitWorkspaceBoundary(root, options.workspace, baselines),
+  );
+}
+
+function implicitWorkspaceBoundary(
+  root: string,
+  workspace: string,
+  baselines: string[],
+): boolean {
+  return (
+    process.platform === "linux" &&
+    workspaceBoundaryException(root, workspace).length > 0 &&
+    !hasBroaderBaseline(root, root, baselines)
+  );
+}
+
+function implicitNativeBoundary(
+  root: string,
+  trustedRoots: string[],
+  baselines: string[],
+): boolean {
+  const canonicalRoot = nativeStatePath();
+  if (!supportedNativeNamespace(canonicalRoot)) return false;
+  const boundary = nativeBoundaryRoot(root, canonicalRoot);
+  if (!boundary) return false;
+  const descendant = trustedRoots.some((read) =>
+    insideRuntimeRoot(boundary, read),
+  );
+  return descendant && !hasBroaderBaseline(root, boundary, baselines);
+}
+
+function nativeBoundaryRoot(
+  root: string,
+  canonicalRoot: string,
+): string | null {
+  if (nativeStateProtectedRoots().includes(root)) return canonicalRoot;
+  return insideRuntimeRoot(canonicalRoot, root) ? root : null;
+}
+
+function hasBroaderBaseline(
+  root: string,
+  boundary: string,
+  baselines: string[],
+): boolean {
+  return baselines.some(
+    (baseline) =>
+      insideRuntimeRoot(baseline, boundary) ||
+      insideRuntimeRoot(baseline, root),
+  );
+}
+
+function supportedNativeNamespace(root: string): boolean {
+  if (process.platform === "linux")
+    return [
+      "/var/tmp/sevro-native-private",
+      "/private/var/tmp/sevro-native-private",
+    ].includes(root);
+  return (
+    process.platform === "darwin" &&
+    /^\/private\/var\/folders\/[^/]+\/[^/]+\/T\/sevro-native-private$/.test(
+      root,
+    )
+  );
+}
+
+/** Codex masks deny ancestors after read mounts; the empty-root policy already hides safe HOME ancestors. */
+function implicitLinuxHomeBoundary(
+  root: string,
+  readRoots: string[],
+  baselines: string[],
+): boolean {
+  if (!isRuntimeHomeRoot(root)) return false;
+  const descendant = readRoots.some((read) => insideRuntimeRoot(root, read));
+  return (
+    descendant &&
+    !baselines.some((baseline) => insideRuntimeRoot(baseline, root))
+  );
+}
+
+function minimalProtectedRoots(roots: string[]): string[] {
+  return [...new Set(roots)].filter(
+    (root) =>
+      !roots.some(
+        (other) => other !== root && root.startsWith(`${other}${sep}`),
+      ),
+  );
+}
+
+function commandEnvironmentLines(
+  environment: Record<string, string> = {},
+  executableReadRoots: string[],
+): string[] {
+  const systemPath =
+    environment.PATH ??
+    "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+  const path =
+    process.platform === "linux"
+      ? [...executableReadRoots, systemPath].join(":")
+      : systemPath;
+  return [
+    `PATH = ${toml(path)}`,
+    ...Object.entries(environment)
+      .filter(([name]) => !["PATH", "HOME", "TMPDIR"].includes(name))
+      .map(([name, value]) => `${toml(name)} = ${toml(value)}`),
+  ];
+}
+
+function optionalRootLines(
+  root: string | undefined,
+  permission: string,
+): string[] {
+  return root ? [`${toml(root)} = ${toml(permission)}`] : [];
+}
+
+function readRootLines(
+  options: Parameters<typeof codexPermissionProfile>[0],
+): string[] {
+  return profileReadRoots(options)
+    .sort()
+    .map((path) => `${toml(path)} = "read"`);
+}
+
+function profileReadRoots(
+  options: Parameters<typeof codexPermissionProfile>[0],
+): string[] {
+  const roots = [
+    ...options.executableReadRoots,
+    ...(options.runtimeReadRoots ?? []),
+    ...(options.nativeReadRoots ?? []),
+  ];
+  if (options.pluginReadRoot) roots.push(options.pluginReadRoot);
+  return [...new Set(roots)];
+}
+
+function readRoot(path: string): boolean {
+  return isAbsolute(path) && path !== "/";
+}
+
+function optionalReadRoot(path: string | undefined): boolean {
+  return path === undefined || readRoot(path);
+}
+
+function validProfilePaths(
+  options: Parameters<typeof codexPermissionProfile>[0],
+): boolean {
+  const privatePaths = [
+    options.workspace,
+    options.commandHome,
+    options.commandTemp,
+  ];
+  return (
+    privatePaths.every(isAbsolute) &&
+    validExecutableRoots(options.executableReadRoots) &&
+    optionalReadRoot(options.pluginReadRoot) &&
+    validProtectedRoots(options.protectedRoots)
+  );
+}
+
+function validExecutableRoots(paths: string[]): boolean {
+  return paths.length > 0 && paths.every(readRoot);
+}
+
+function validProtectedRoots(paths: string[]): boolean {
+  return paths.length > 0 && paths.every(isAbsolute);
+}

package/src/hosts/codex-session-files.ts

@@ -0,0 +1,106 @@
+import type { Dirent } from "node:fs";
+import { lstat, readFile, readdir, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { isMissingFile } from "../fixtures/tools";
+
+const MAX_SESSION_BYTES = 8 * 1024 * 1024;
+const MAX_SESSION_FILES = 1024;
+const THREAD_ID = /^[A-Za-z0-9._-]{1,128}$/;
+type SearchStatus = "partial" | "unavailable" | "ambiguous";
+type SessionLocation =
+  { status: SearchStatus } | { status: "found"; path: string };
+
+async function sessionsRootStatus(
+  root: string,
+): Promise<"valid" | "partial" | "unavailable"> {
+  try {
+    const entry = await lstat(root);
+    return entry.isDirectory() && !entry.isSymbolicLink() ? "valid" : "partial";
+  } catch (error) {
+    return isMissingFile(error) ? "unavailable" : "partial";
+  }
+}
+
+class SessionSearch {
+  private pending: string[];
+  private matches: string[] = [];
+  private visited = 0;
+  constructor(
+    root: string,
+    private suffix: string,
+  ) {
+    this.pending = [root];
+  }
+
+  async run(): Promise<SessionLocation> {
+    while (this.pending.length) {
+      const directory = this.pending.pop();
+      if (directory === undefined) break;
+      try {
+        const status = await this.visitDirectory(directory);
+        if (status) return { status };
+      } catch {
+        return { status: "partial" };
+      }
+    }
+    const [path] = this.matches;
+    return this.location(path);
+  }
+
+  private location(path: string | undefined): SessionLocation {
+    return this.matches.length === 1 && path !== undefined
+      ? { status: "found", path }
+      : { status: "unavailable" };
+  }
+
+  private async visitDirectory(
+    directory: string,
+  ): Promise<SearchStatus | undefined> {
+    const entries = await readdir(directory, { withFileTypes: true });
+    for (const entry of entries) {
+      const status = this.visitEntry(directory, entry);
+      if (status) return status;
+    }
+    return undefined;
+  }
+
+  private visitEntry(
+    directory: string,
+    entry: Dirent,
+  ): SearchStatus | undefined {
+    this.visited++;
+    if (this.visited > MAX_SESSION_FILES || entry.isSymbolicLink())
+      return "partial";
+    return this.collectCandidate(directory, entry);
+  }
+
+  private collectCandidate(
+    directory: string,
+    entry: Dirent,
+  ): SearchStatus | undefined {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) this.pending.push(path);
+    else if (entry.isFile() && entry.name.endsWith(this.suffix))
+      this.matches.push(path);
+    return this.matches.length > 1 ? "ambiguous" : undefined;
+  }
+}
+
+/** Locate exactly one original thread while refusing symlinks and bounded tree overflow. */
+export async function locateNativeSession(
+  home: string,
+  threadId: string,
+): Promise<SessionLocation> {
+  if (!THREAD_ID.test(threadId)) return { status: "partial" };
+  const root = join(home, "sessions");
+  const status = await sessionsRootStatus(root);
+  if (status !== "valid") return { status };
+  return new SessionSearch(root, `-${threadId}.jsonl`).run();
+}
+
+export async function readNativeSession(path: string): Promise<string | null> {
+  if ((await stat(path)).size > MAX_SESSION_BYTES) return null;
+  const bytes = await readFile(path);
+  if (bytes.byteLength > MAX_SESSION_BYTES) return null;
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}