@bjoernrochel/sevro 0.1.0-rc.8 → 1.1.0

package/src/hosts/codex-state.ts

@@ -1,12 +1,19 @@
-import { runtimeSeedSources } from "../runtime-config";
+import { runtimeLocalHttpEnabled, runtimeSeedSources } from "../runtime/config";
+import { shellQuote } from "../shell";
 import {
   candidateArtifactEnvironment,
   candidateArtifactReadRoots,
 } from "../candidate-artifacts";
+import {
+  codexStateEnabled,
+  retainCandidateCodexState,
+} from "../candidate-codex-state";
 import { randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
+import { isMissingFile } from "../fixtures/tools";
 import {
   cp,
+  lstat,
   mkdir,
   readFile,
   realpath,
@@ -21,12 +28,17 @@ import {
   candidateTranscriptEnvironment,
   candidateTranscriptRoots,
 } from "../native-transcripts";
-import { prepareHookMounts } from "../runtime-hooks";
+import { prepareHookMounts } from "../runtime/hooks";
+import { requireNativeHookRoots } from "../native-transcript-state";
 import {
   requireRuntimeReadRoots,
   runtimeExecutableProtection,
-} from "../runtime-paths";
-import { prepareRuntimeState } from "../runtime-state";
+} from "../runtime/paths";
+import { prepareRuntimeState } from "../runtime/state";
+import {
+  sharedCacheDenyRoots,
+  sharedCacheRoots,
+} from "../runtime/shared-cache";
 import { codexPermissionProfile } from "./codex-profile";
 import { evaluationProtectedRoots } from "./isolation-roots";
 type Request = Parameters<HostAdapter["run"]>[0];
@@ -44,6 +56,7 @@ export interface CodexHostOptions {
   agentConcurrencyLimit?: number | null;
   timeoutMs?: number;
   entrypoint?: "exec" | "app-server";
+  retainHostDiagnostics?: boolean;
   /** Integration-test seam; production uses the same CLI for execution and preflight. */
   sandboxBinary?: string;
 }
@@ -64,23 +77,22 @@ async function copyAuth(source: string, target: string): Promise<void> {
   await writeFile(target, bytes, { flag: "wx", mode: 0o600 });
 }
 
-function shellQuote(value: string): string {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-
 export async function codexHookMounts(
   request: Request,
   state: CodexState,
   installedPluginRoots: string[],
 ) {
-  if (!request.runtimePolicy) return undefined;
   const hooks = await prepareHookMounts({
     workspace: request.workspace,
-    stateRoot: join(request.workspace, ".git", "sevro-runtime"),
+    stateRoot: state.stateRoot,
     privateRoot: state.codexHome,
     pluginRoots: installedPluginRoots,
     protectedRoots: state.protectedRoots,
-    policy: request.runtimePolicy,
+    policy: request.runtimePolicy ?? {
+      format: "sevro.runtime.v1",
+      environment: {},
+      readOnlyRoots: [],
+    },
   });
   for (const [index, root] of installedPluginRoots.entries()) {
     const curated = hooks.directories[index];
@@ -88,9 +100,28 @@ export async function codexHookMounts(
     await rm(root, { recursive: true });
     await cp(curated, root, { recursive: true });
   }
+  await grantCodexHookReads(state, hooks.directories);
   return hooks;
 }
 
+/** Hooks advertise paths relative to these curated copies, not the install cache. */
+async function grantCodexHookReads(
+  state: CodexState,
+  roots: string[],
+): Promise<void> {
+  if (roots.length === 0) return;
+  await requireNativeHookRoots(roots, state.codexHome);
+  const path = join(state.codexHome, "config.toml");
+  const config = await readFile(path, "utf8");
+  const header = `[permissions.${state.profileId}.filesystem]\n`;
+  const grants = roots
+    .map((root) => `${JSON.stringify(root)} = "read"\n`)
+    .join("");
+  await writeFile(path, config.replace(header, header + grants), {
+    mode: 0o600,
+  });
+}
+
 async function privateCodexDirectories(stateRoot: string) {
   const codexHome = join(stateRoot, "codex-home"),
     parentHome = join(stateRoot, "home"),
@@ -145,9 +176,14 @@ async function writeCodexProfile(
   protectedRoots: string[],
   limit: number | null,
   commandEnvironment = request.runtimePolicy?.environment,
-  runtimeWriteRoot?: string,
+  runtimeWriteRoot: string | undefined,
+  writableCacheRoots: string[],
 ): Promise<void> {
   const profile = codexPermissionProfile({
+    localHttp: runtimeLocalHttpEnabled(
+      request.runtimePolicy,
+      request.runtimeRole ?? "candidate",
+    ),
     commandEnvironment: codexProfileEnvironment(
       request,
       paths,
@@ -156,6 +192,10 @@ async function writeCodexProfile(
     runtimeWriteRoot,
     runtimeReadRoots: request.runtimePolicy?.readOnlyRoots,
     nativeReadRoots: codexNativeReadRoots(request, paths.codexHome),
+    nativeWriteRoots: [
+      ...codexStateWriteRoots(request, paths),
+      ...writableCacheRoots,
+    ],
     id: profileId,
     workspace: request.workspace,
     commandHome: paths.commandHome,
@@ -166,11 +206,17 @@ async function writeCodexProfile(
   });
   await writeFile(
     join(paths.codexHome, "config.toml"),
-    profile + concurrencyConfiguration(limit),
+    profile +
+      concurrencyConfiguration(limit) +
+      fixtureTrustConfiguration(request),
     { flag: "wx", mode: 0o600 },
   );
 }
 
+function fixtureTrustConfiguration(request: Request): string {
+  return `\n[projects.${JSON.stringify(request.workspace)}]\ntrust_level = "untrusted"\n`;
+}
+
 function codexProfileEnvironment(
   request: Request,
   paths: Awaited<ReturnType<typeof privateCodexDirectories>>,
@@ -181,6 +227,11 @@ function codexProfileEnvironment(
     ...codexTranscriptEnvironment(request, paths.codexHome),
     ...candidateTranscriptEnvironment(request.candidateTranscriptRoot),
     ...candidateArtifactEnvironment(request.candidateArtifactRoots),
+    ...(request.runtimePolicy?.codexState === true
+      ? {
+          SEVRO_CODEX_AGENT_SKILLS: join(paths.parentHome, ".agents", "skills"),
+        }
+      : {}),
   };
 }
 
@@ -188,14 +239,23 @@ function codexTranscriptEnvironment(
   request: Request,
   home: string,
 ): Record<string, string> {
-  return request.runtimePolicy?.nativeTranscripts === true
-    ? { CODEX_HOME: home, SEVRO_NATIVE_TRANSCRIPT_ROOT: join(home, "sessions") }
-    : {};
+  return {
+    ...(request.runtimePolicy?.codexState === true ? { CODEX_HOME: home } : {}),
+    ...(request.runtimePolicy?.nativeTranscripts === true
+      ? {
+          CODEX_HOME: home,
+          SEVRO_NATIVE_TRANSCRIPT_ROOT: join(home, "sessions"),
+        }
+      : {}),
+  };
 }
 
 function codexNativeReadRoots(request: Request, home: string) {
   return [
     ...linuxArg0ReadRoots(home),
+    ...(request.runtimePolicy?.codexState === true
+      ? [join(home, "config.toml"), join(home, "skills", ".system")]
+      : []),
     ...codexTranscriptRoots(request, home),
     ...candidateTranscriptRoots(request.candidateTranscriptRoot),
     ...candidateArtifactReadRoots(request.candidateArtifactRoots),
@@ -321,7 +381,11 @@ function applyCodexRuntime(
 function codexRuntimeProfile(
   runtime: Awaited<ReturnType<typeof codexRuntime>>,
 ) {
-  return { environment: runtime?.environment, root: runtime?.root };
+  return {
+    environment: runtime?.environment,
+    root: runtime?.root,
+    writableCacheRoots: runtime?.writableCacheRoots ?? [],
+  };
 }
 
 export async function prepareCodexState(
@@ -331,6 +395,7 @@ export async function prepareCodexState(
   request: Request,
   helperRoot?: string,
 ) {
+  await requireIsolatedGitMetadata(request.workspace);
   const paths = await privateCodexDirectories(stateRoot);
   const runtime = await codexRuntime(request, paths, stateRoot);
   await copyAuth(options.authFile, join(paths.codexHome, "auth.json"));
@@ -356,6 +421,14 @@ export async function prepareCodexState(
   );
   if (helperRoot) readRoots.push(helperRoot);
   requireCodexRuntimeReadRoots(request, protectedRoots);
+  await sharedCacheRoots(
+    request.runtimePolicy,
+    request.runtimeRole,
+    protectedRoots,
+  );
+  protectedRoots.push(
+    ...sharedCacheDenyRoots(request.runtimePolicy, request.runtimeRole),
+  );
   requireUnprotectedExecutables(
     readRoots,
     runtimeExecutableProtection(
@@ -375,11 +448,54 @@ export async function prepareCodexState(
     limit,
     runtimeProfile.environment,
     runtimeProfile.root,
+    runtimeProfile.writableCacheRoots,
   );
   const shellRoot = await fixtureShellRoot(request, paths.parentHome);
   const env = codexEnvironment(paths, request, shellRoot);
   applyCodexRuntime(runtime, env, paths);
-  return { ...paths, sandboxBinary, profileId, env, protectedRoots };
+  await prepareCodexStateEvidence(request, stateRoot, paths);
+  return { ...paths, stateRoot, sandboxBinary, profileId, env, protectedRoots };
+}
+
+function codexStateWriteRoots(
+  request: Request,
+  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,
+): string[] {
+  return codexStateEnabled(request.runtimePolicy)
+    ? [
+        join(paths.codexHome, "skills"),
+        join(paths.parentHome, ".agents", "skills"),
+        join(paths.commandHome, ".agents", "skills"),
+        join(paths.commandHome, ".codex", "skills"),
+      ]
+    : [];
+}
+
+async function prepareCodexStateEvidence(
+  request: Request,
+  stateRoot: string,
+  paths: Awaited<ReturnType<typeof privateCodexDirectories>>,
+): Promise<void> {
+  if (!codexStateEnabled(request.runtimePolicy)) return;
+  const skillRoots = codexStateWriteRoots(request, paths);
+  await Promise.all(
+    skillRoots.map((root) => mkdir(root, { recursive: true, mode: 0o700 })),
+  );
+  await mkdir(join(paths.codexHome, "skills", ".system"), { mode: 0o700 });
+  await retainCandidateCodexState(
+    request.candidateRuntimeRoot,
+    stateRoot,
+    paths,
+  );
+}
+
+async function requireIsolatedGitMetadata(workspace: string): Promise<void> {
+  try {
+    if (!(await lstat(join(workspace, ".git"))).isDirectory())
+      throw new Error("Codex Git metadata must be an isolated directory");
+  } catch (cause) {
+    if (!isMissingFile(cause)) throw cause;
+  }
 }
 
 function requireCodexRuntimeReadRoots(