@bjoernrochel/sevro 0.1.0-rc.21 → 0.1.0-rc.22

package/docs/installing.md

@@ -23,10 +23,10 @@ Local installation records the selected version in the project lockfile.
 
 ## Current release
 
-The current release is `0.1.0-rc.21`. Install this exact version:
+The current release is `0.1.0-rc.22`. Install this exact version:
 
 ```sh
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.21
+bun add --exact @bjoernrochel/sevro@0.1.0-rc.22
 ```
 
 <!-- sevro-current-release:end -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bjoernrochel/sevro",
-  "version": "0.1.0-rc.21",
+  "version": "0.1.0-rc.22",
   "license": "SEE LICENSE IN LICENSE",
   "description": "A standalone evaluation runner for agentic coding capabilities",
   "type": "module",

package/src/hosts/codex-state.ts

@@ -28,6 +28,7 @@ import {
   candidateTranscriptRoots,
 } from "../native-transcripts";
 import { prepareHookMounts } from "../runtime/hooks";
+import { requireNativeHookRoots } from "../native-transcript-state";
 import {
   requireRuntimeReadRoots,
   runtimeExecutableProtection,
@@ -102,9 +103,28 @@ export async function codexHookMounts(
     await rm(root, { recursive: true });
     await cp(curated, root, { recursive: true });
   }
+  await grantCodexHookReads(state, hooks.directories);
   return hooks;
 }
 
+/** Hooks advertise paths relative to these curated copies, not the install cache. */
+async function grantCodexHookReads(
+  state: CodexState,
+  roots: string[],
+): Promise<void> {
+  if (roots.length === 0) return;
+  await requireNativeHookRoots(roots, state.codexHome);
+  const path = join(state.codexHome, "config.toml");
+  const config = await readFile(path, "utf8");
+  const header = `[permissions.${state.profileId}.filesystem]\n`;
+  const grants = roots
+    .map((root) => `${JSON.stringify(root)} = "read"\n`)
+    .join("");
+  await writeFile(path, config.replace(header, header + grants), {
+    mode: 0o600,
+  });
+}
+
 async function privateCodexDirectories(stateRoot: string) {
   const codexHome = join(stateRoot, "codex-home"),
     parentHome = join(stateRoot, "home"),