@bjoernrochel/sevro 0.1.0-rc.7 → 1.0.0

package/src/hosts/codex-native-calls.ts

@@ -1,14 +1,12 @@
 import { isRecord, isUnknownArray } from "../value-guards";
-import { nativeCommandOutputs } from "./codex-command-output";
+import {
+  codexExecCallReceipts,
+  type ExecCallReceipt,
+} from "./codex-exec-controls";
 import {
   readNativeSession,
-  readNativeSessionText,
   locateNativeSession as sessionPath,
 } from "./codex-session-files";
-import {
-  codexNativeReadDiagnostic,
-  type NativeReadDiagnostic,
-} from "./codex-skill-reads";
 
 const MAX_SESSION_ENTRIES = 10_000;
 const MAX_RETAINED_CALLS = 128;
@@ -63,7 +61,6 @@ interface ChildSession {
   threadId: string;
   status: "available" | "unavailable" | "ambiguous" | "partial";
   resultStatus?: "completed" | "unavailable";
-  readDiagnostics?: NativeReadDiagnostic;
   nestedSpawns?: NestedSpawn[];
   requestsTruncated?: boolean;
 }
@@ -81,9 +78,7 @@ interface NestedSpawn {
   readerResultStatus: "completed" | "unavailable";
 }
 
-interface NativeSkillContext {
-  workspace: string;
-  installedPluginRoots: string[];
+interface NativeCallContext {
   followUpPrompt?: string;
 }
 
@@ -95,9 +90,9 @@ interface NativeCallObservation {
     calls: NativeCall[];
     toolCalls: NativeToolCall[];
     submittedExecCalls: number;
+    execCalls?: ExecCallReceipt[];
     acceptedSpawns: AcceptedSpawn[];
     feedbackCalls: NativeFeedbackCall[];
-    parentReadDiagnostics?: NativeReadDiagnostic;
     childSessions: ChildSession[];
     childrenTruncated: boolean;
   };
@@ -531,6 +526,9 @@ function sessionObservation(
       calls: state.calls,
       toolCalls: state.toolCalls,
       submittedExecCalls: state.submittedExecCalls,
+      ...(state.submittedExecCalls > 0
+        ? { execCalls: codexExecCallReceipts(state.entries) }
+        : {}),
       ...sessionReceipts(state, followUpPrompt),
       childSessions: [],
       childrenTruncated: false,
@@ -696,7 +694,6 @@ async function childSessionStatus(
   home: string,
   parentThread: string,
   threadId: string,
-  skillContext?: NativeSkillContext,
   rootThread?: string,
 ): Promise<ChildSession> {
   if (threadId === parentThread) return { threadId, status: "partial" };
@@ -705,41 +702,21 @@ async function childSessionStatus(
   try {
     const text = await readNativeSession(located.path);
     if (text === null) return { threadId, status: "partial" };
-    return await availableChildSession(
-      home,
-      threadId,
-      text,
-      skillContext,
-      rootThread,
-    );
+    return await availableChildSession(home, threadId, text, rootThread);
   } catch {
     return { threadId, status: "partial" };
   }
 }
 
-async function readDiagnostics(
-  entries: NativeEntry[],
-  context: NativeSkillContext | undefined,
-) {
-  return context
-    ? codexNativeReadDiagnostic(
-        entries,
-        context.workspace,
-        context.installedPluginRoots,
-      )
-    : undefined;
-}
 async function availableChildSession(
   home: string,
   threadId: string,
   text: string,
-  context: NativeSkillContext | undefined,
   rootThread: string | undefined,
 ): Promise<ChildSession> {
   const parsed = parseSession(text);
   if (parsed.observation.completeness !== "complete")
     return { threadId, status: "partial" };
-  const diagnostics = await readDiagnostics(parsed.entries, context);
   const nested = rootThread
     ? await nestedSpawnReceipts(home, rootThread, threadId, parsed.entries)
     : undefined;
@@ -749,7 +726,6 @@ async function availableChildSession(
     resultStatus: childResultCompleted(parsed.entries)
       ? "completed"
       : "unavailable",
-    ...(diagnostics ? { readDiagnostics: diagnostics } : {}),
     ...nested,
   };
 }
@@ -779,7 +755,7 @@ function lastSessionOrdinal(text: string): number | null {
 export async function codexNativeCallObservation(
   home: string,
   threadId: string,
-  skillContext?: NativeSkillContext,
+  context?: NativeCallContext,
 ): Promise<NativeCallObservation> {
   const located = await sessionPath(home, threadId);
   if (located.status !== "found")
@@ -791,7 +767,7 @@ export async function codexNativeCallObservation(
       home,
       threadId,
       located.path,
-      skillContext,
+      context,
     );
   } catch {
     return unavailable("partial");
@@ -802,109 +778,26 @@ async function nativeSessionObservation(
   home: string,
   threadId: string,
   path: string,
-  skillContext: NativeSkillContext | undefined,
+  context: NativeCallContext | undefined,
 ): Promise<NativeCallObservation> {
   const text = await readNativeSession(path);
   if (text === null) return unavailable("partial");
-  const { observation, entries } = parseSession(
-    text,
-    skillContext?.followUpPrompt,
-  );
+  const { observation } = parseSession(text, context?.followUpPrompt);
   if (observation.completeness !== "complete") return observation;
-  const parentReadDiagnostics = await readDiagnostics(entries, skillContext);
   const children = [
     ...new Set(observation.data.acceptedSpawns.map((spawn) => spawn.threadId)),
   ];
   const childSessions = await Promise.all(
     children
       .slice(0, MAX_CHILD_SESSIONS)
-      .map((child) =>
-        childSessionStatus(home, threadId, child, skillContext, threadId),
-      ),
+      .map((child) => childSessionStatus(home, threadId, child, threadId)),
   );
   return {
     ...observation,
     data: {
       ...observation.data,
-      ...(parentReadDiagnostics ? { parentReadDiagnostics } : {}),
       childSessions,
       childrenTruncated: children.length > MAX_CHILD_SESSIONS,
     },
   };
 }
-
-/** Actor-local recovery stays in host memory and never enters public observations. */
-export async function codexNativeSkillReadRecovery(
-  home: string,
-  threadId: string,
-): Promise<Map<string, { command: string; output: string }>> {
-  const found = await sessionPath(home, threadId);
-  if (found.status !== "found") return new Map();
-  try {
-    const text = await readNativeSessionText(found.path);
-    if (text === null) return new Map();
-    const parsed = parseSession(text);
-    if (parsed.observation.completeness !== "complete") return new Map();
-    return recoveredSessionReads(parsed.entries);
-  } catch {
-    return new Map();
-  }
-}
-
-function completedCommandItem(
-  payload: Record<string, unknown>,
-): Record<string, unknown> | null {
-  if (payload.type !== "item_completed") return null;
-  if (!isRecord(payload.item) || payload.item.type !== "CommandExecution")
-    return null;
-  return payload.item;
-}
-function commandIdentityCounts(entries: NativeEntry[]): Map<string, number> {
-  const counts = new Map<string, number>();
-  for (const { payload } of entries) {
-    const item = completedCommandItem(payload);
-    if (typeof item?.id === "string")
-      counts.set(item.id, (counts.get(item.id) ?? 0) + 1);
-  }
-  return counts;
-}
-function uniqueRecoveryItem(
-  payload: Record<string, unknown>,
-  counts: Map<string, number>,
-) {
-  const item = completedCommandItem(payload);
-  if (!item || typeof item.id !== "string" || counts.get(item.id) !== 1)
-    return null;
-  return { id: item.id, command: item.command };
-}
-function recoveredLiteralCommand(command: unknown): string | null {
-  if (!isUnknownArray(command) || command.length !== 3) return null;
-  if (
-    !["-c", "-lc"].includes(String(command[1])) ||
-    typeof command[2] !== "string"
-  )
-    return null;
-  return command[2];
-}
-function recoveredSessionReads(
-  entries: NativeEntry[],
-): Map<string, { command: string; output: string }> {
-  const output = nativeCommandOutputs(entries);
-  const counts = commandIdentityCounts(entries);
-  const recovered = new Map<string, { command: string; output: string }>();
-  for (const { ordinal, payload } of entries) {
-    const item = uniqueRecoveryItem(payload, counts);
-    if (!item) continue;
-    const read = recoveredCommandRead(
-      item.command,
-      output.get(ordinal)?.output,
-    );
-    if (read) recovered.set(item.id, read);
-  }
-  return recovered;
-}
-function recoveredCommandRead(value: unknown, output: string | undefined) {
-  if (output === undefined) return null;
-  const command = recoveredLiteralCommand(value);
-  return command === null ? null : { command, output };
-}

package/src/hosts/codex-process.ts

@@ -1,61 +1,17 @@
 import {
-  awaitHostProcess,
-  boundedProcessText,
-  MAX_EVENT_BYTES,
+  HostProcessFailure,
+  runHostProcess,
+  type HostProcessOptions,
+  type HostProcessResult,
+  type Phase,
 } from "./process-lifecycle";
 
-function stopProcess(proc: Bun.Subprocess): void {
-  if (process.platform !== "win32") {
-    try {
-      process.kill(-proc.pid, "SIGKILL");
-      return;
-    } catch {
-      // The group may have exited before cancellation.
-    }
-  }
-  try {
-    proc.kill("SIGKILL");
-  } catch {
-    // The process already exited.
+export class CodexProcessFailure extends HostProcessFailure {
+  constructor(phase: Phase, result: HostProcessResult) {
+    super("Codex", phase, result);
   }
 }
 
-export async function runCodexProcess(options: {
-  argv: string[];
-  cwd: string;
-  env: Record<string, string>;
-  input?: string;
-  timeoutMs: number;
-  signal?: AbortSignal;
-}): Promise<{ code: number; out: string }> {
-  if (options.signal?.aborted) throw new Error("Codex run cancelled");
-  const proc = Bun.spawn(options.argv, {
-    cwd: options.cwd,
-    env: options.env,
-    detached: process.platform !== "win32",
-    stdin: options.input === undefined ? "ignore" : "pipe",
-    stdout: "pipe",
-    stderr: "ignore",
-  });
-  const written = (async () => {
-    if (options.input === undefined) return;
-    if (!proc.stdin || typeof proc.stdin === "number")
-      throw new Error("Codex input pipe unavailable");
-    await proc.stdin.write(options.input);
-    await proc.stdin.end();
-  })();
-  const completed = Promise.all([
-    boundedProcessText(
-      proc.stdout,
-      MAX_EVENT_BYTES,
-      "Codex event stream exceeds the size limit",
-    ),
-    proc.exited,
-    written,
-  ]).then(([out, code]) => ({ out, code }));
-  return awaitHostProcess(proc, completed, {
-    ...options,
-    host: "Codex",
-    stop: stopProcess,
-  });
+export function runCodexProcess(options: Omit<HostProcessOptions, "host">) {
+  return runHostProcess({ ...options, host: "Codex" });
 }

package/src/hosts/codex-profile.ts

@@ -1,5 +1,8 @@
-import { isAbsolute, sep } from "node:path";
-import { insideRuntimeRoot, isRuntimeHomeRoot } from "../runtime-paths";
+import { isAbsolute, join, sep } from "node:path";
+import { minimalRoots as minimalProtectedRoots } from "../paths";
+import { containsControl } from "../value-guards";
+import { insideRuntimeRoot, isRuntimeHomeRoot } from "../runtime/paths";
+import { workspaceBoundaryException } from "../fixtures/workspace-state";
 import {
   nativeStatePath,
   nativeStateProtectedRoots,
@@ -17,12 +20,7 @@ const LINUX_MINIMAL_READ_ROOTS = [
 ];
 
 function toml(value: string): string {
-  if (
-    Array.from(value).some(
-      (character) =>
-        character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f,
-    )
-  )
+  if (containsControl(value))
     throw new Error("Codex profile value contains a control character");
   return JSON.stringify(value);
 }
@@ -39,7 +37,9 @@ export function codexPermissionProfile(options: {
   commandEnvironment?: Record<string, string>;
   runtimeReadRoots?: string[];
   nativeReadRoots?: string[];
+  nativeWriteRoots?: string[];
   runtimeWriteRoot?: string;
+  localHttp?: boolean;
 }): string {
   if (!/^[a-z][a-z0-9_]*$/.test(options.id))
     throw new Error("invalid Codex permission profile ID");
@@ -50,8 +50,7 @@ export function codexPermissionProfile(options: {
     `default_permissions = ${toml(name)}`,
     'approval_policy = "never"',
     "allow_login_shell = false",
-    "[features]",
-    "hooks = false",
+    ...codexFeatureLines(options.localHttp),
     "",
     "[shell_environment_policy]",
     'inherit = "none"',
@@ -64,6 +63,7 @@ export function codexPermissionProfile(options: {
     ),
     `HOME = ${toml(options.commandHome)}`,
     `TMPDIR = ${toml(options.commandTemp)}`,
+    `TMPPREFIX = ${toml(join(options.commandTemp, sep))}`,
     "",
     `[permissions.${name}]`,
     'extends = ":workspace"',
@@ -78,30 +78,55 @@ export function codexPermissionProfile(options: {
       .sort()
       .map((root) => `${toml(root)} = "deny"`),
     ...readRootLines(options),
+    ...(options.nativeWriteRoots ?? []).map(
+      (root) => `${toml(root)} = "write"`,
+    ),
     `${toml(options.commandHome)} = "write"`,
     `${toml(options.commandTemp)} = "write"`,
     ...optionalRootLines(options.runtimeWriteRoot, "write"),
+    // Override Codex's metadata carveout only for this isolated fixture.
+    `${toml(join(options.workspace, ".git"))} = "write"`,
     "",
     `[permissions.${name}.filesystem.":workspace_roots"]`,
     '"." = "write"',
     "",
     `[permissions.${name}.network]`,
-    "enabled = false",
+    ...networkProfile(options.localHttp),
     "",
   ].join("\n");
 }
 
+function codexFeatureLines(localHttp: boolean | undefined): string[] {
+  return [
+    "[features]",
+    "hooks = false",
+    ...(localHttp ? ["network_proxy = true"] : []),
+  ];
+}
+
+function networkProfile(localHttp: boolean | undefined): string[] {
+  if (!localHttp) return ["enabled = false"];
+  return [
+    "enabled = true",
+    "allow_local_binding = true",
+    "allow_upstream_proxy = false",
+    'domains = { "localhost" = "allow", "127.0.0.1" = "allow", "::1" = "allow" }',
+  ];
+}
+
 function profileProtectedRoots(
   options: Parameters<typeof codexPermissionProfile>[0],
 ): string[] {
   const readRoots = profileReadRoots(options);
   const trustedRoots = [
     ...readRoots,
+    ...(options.nativeWriteRoots ?? []),
     ...(options.runtimeWriteRoot ? [options.runtimeWriteRoot] : []),
   ];
   const baselines = [
     ...LINUX_MINIMAL_READ_ROOTS,
     ...readRoots,
+    ...(options.nativeWriteRoots ?? []),
     options.workspace,
     options.commandHome,
     options.commandTemp,
@@ -111,7 +136,20 @@ function profileProtectedRoots(
     (root) =>
       (!implicitLinuxHomeBoundary(root, readRoots, baselines) ||
         process.platform !== "linux") &&
-      !implicitNativeBoundary(root, trustedRoots, baselines),
+      !implicitNativeBoundary(root, trustedRoots, baselines) &&
+      !implicitWorkspaceBoundary(root, options.workspace, baselines),
+  );
+}
+
+function implicitWorkspaceBoundary(
+  root: string,
+  workspace: string,
+  baselines: string[],
+): boolean {
+  return (
+    process.platform === "linux" &&
+    workspaceBoundaryException(root, workspace).length > 0 &&
+    !hasBroaderBaseline(root, root, baselines)
   );
 }
 
@@ -178,15 +216,6 @@ function implicitLinuxHomeBoundary(
   );
 }
 
-function minimalProtectedRoots(roots: string[]): string[] {
-  return [...new Set(roots)].filter(
-    (root) =>
-      !roots.some(
-        (other) => other !== root && root.startsWith(`${other}${sep}`),
-      ),
-  );
-}
-
 function commandEnvironmentLines(
   environment: Record<string, string> = {},
   executableReadRoots: string[],

package/src/hosts/codex-session-files.ts

@@ -1,7 +1,7 @@
 import type { Dirent } from "node:fs";
 import { lstat, readFile, readdir, stat } from "node:fs/promises";
 import { join } from "node:path";
-import { isMissingFile } from "../fixture-tools";
+import { isMissingFile } from "../fixtures/tools";
 
 const MAX_SESSION_BYTES = 8 * 1024 * 1024;
 const MAX_SESSION_FILES = 1024;
@@ -104,11 +104,3 @@ export async function readNativeSession(path: string): Promise<string | null> {
   if (bytes.byteLength > MAX_SESSION_BYTES) return null;
   return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
 }
-
-export async function readNativeSessionText(
-  path: string,
-): Promise<string | null> {
-  if ((await stat(path)).size > MAX_SESSION_BYTES) return null;
-  const text = await readFile(path, "utf8");
-  return Buffer.byteLength(text) > MAX_SESSION_BYTES ? null : text;
-}