@bjoernrochel/sevro 1.0.0 → 1.1.1

package/dist/src/hosts/codex-profile.js

@@ -0,0 +1,206 @@
+import { isAbsolute, join, sep } from "node:path";
+import { minimalRoots as minimalProtectedRoots } from "../paths.js";
+import { containsControl } from "../value-guards.js";
+import { insideRuntimeRoot, isRuntimeHomeRoot } from "../runtime/paths.js";
+import { workspaceBoundaryException } from "../fixtures/workspace-state.js";
+import { nativeStatePath, nativeStateProtectedRoots, } from "../native-transcript-state.js";
+const LINUX_MINIMAL_READ_ROOTS = [
+    "/bin",
+    "/sbin",
+    "/usr",
+    "/etc",
+    "/lib",
+    "/lib64",
+    "/nix/store",
+    "/run/current-system/sw",
+];
+function toml(value) {
+    if (containsControl(value))
+        throw new Error("Codex profile value contains a control character");
+    return JSON.stringify(value);
+}
+/** Runner-owned Codex command policy; the Codex parent keeps access to auth. */
+export function codexPermissionProfile(options) {
+    if (!/^[a-z][a-z0-9_]*$/.test(options.id))
+        throw new Error("invalid Codex permission profile ID");
+    if (!validProfilePaths(options))
+        throw new Error("Codex profile paths must be absolute and protected");
+    const name = options.id;
+    return [
+        `default_permissions = ${toml(name)}`,
+        'approval_policy = "never"',
+        "allow_login_shell = false",
+        ...codexFeatureLines(options.localHttp),
+        "",
+        "[shell_environment_policy]",
+        'inherit = "none"',
+        "ignore_default_excludes = false",
+        "",
+        "[shell_environment_policy.set]",
+        ...commandEnvironmentLines(options.commandEnvironment, options.executableReadRoots),
+        `HOME = ${toml(options.commandHome)}`,
+        `TMPDIR = ${toml(options.commandTemp)}`,
+        `TMPPREFIX = ${toml(join(options.commandTemp, sep))}`,
+        "",
+        `[permissions.${name}]`,
+        'extends = ":workspace"',
+        "",
+        `[permissions.${name}.filesystem]`,
+        '":root" = "deny"',
+        '":minimal" = "read"',
+        ...(process.platform === "linux"
+            ? []
+            : ['":tmpdir" = "deny"', '":slash_tmp" = "deny"']),
+        ...minimalProtectedRoots(profileProtectedRoots(options))
+            .sort()
+            .map((root) => `${toml(root)} = "deny"`),
+        ...readRootLines(options),
+        ...(options.nativeWriteRoots ?? []).map((root) => `${toml(root)} = "write"`),
+        `${toml(options.commandHome)} = "write"`,
+        `${toml(options.commandTemp)} = "write"`,
+        ...optionalRootLines(options.runtimeWriteRoot, "write"),
+        // Override Codex's metadata carveout only for this isolated fixture.
+        `${toml(join(options.workspace, ".git"))} = "write"`,
+        "",
+        `[permissions.${name}.filesystem.":workspace_roots"]`,
+        '"." = "write"',
+        "",
+        `[permissions.${name}.network]`,
+        ...networkProfile(options.localHttp),
+        "",
+    ].join("\n");
+}
+function codexFeatureLines(localHttp) {
+    return [
+        "[features]",
+        "hooks = false",
+        ...(localHttp ? ["network_proxy = true"] : []),
+    ];
+}
+function networkProfile(localHttp) {
+    if (!localHttp)
+        return ["enabled = false"];
+    return [
+        "enabled = true",
+        "allow_local_binding = true",
+        "allow_upstream_proxy = false",
+        'domains = { "localhost" = "allow", "127.0.0.1" = "allow", "::1" = "allow" }',
+    ];
+}
+function profileProtectedRoots(options) {
+    const readRoots = profileReadRoots(options);
+    const trustedRoots = [
+        ...readRoots,
+        ...(options.nativeWriteRoots ?? []),
+        ...(options.runtimeWriteRoot ? [options.runtimeWriteRoot] : []),
+    ];
+    const baselines = [
+        ...LINUX_MINIMAL_READ_ROOTS,
+        ...readRoots,
+        ...(options.nativeWriteRoots ?? []),
+        options.workspace,
+        options.commandHome,
+        options.commandTemp,
+        ...(options.runtimeWriteRoot ? [options.runtimeWriteRoot] : []),
+    ];
+    return options.protectedRoots.filter((root) => (!implicitLinuxHomeBoundary(root, readRoots, baselines) ||
+        process.platform !== "linux") &&
+        !implicitNativeBoundary(root, trustedRoots, baselines) &&
+        !implicitWorkspaceBoundary(root, options.workspace, baselines));
+}
+function implicitWorkspaceBoundary(root, workspace, baselines) {
+    return (process.platform === "linux" &&
+        workspaceBoundaryException(root, workspace).length > 0 &&
+        !hasBroaderBaseline(root, root, baselines));
+}
+function implicitNativeBoundary(root, trustedRoots, baselines) {
+    const canonicalRoot = nativeStatePath();
+    if (!supportedNativeNamespace(canonicalRoot))
+        return false;
+    const boundary = nativeBoundaryRoot(root, canonicalRoot);
+    if (!boundary)
+        return false;
+    const descendant = trustedRoots.some((read) => insideRuntimeRoot(boundary, read));
+    return descendant && !hasBroaderBaseline(root, boundary, baselines);
+}
+function nativeBoundaryRoot(root, canonicalRoot) {
+    if (nativeStateProtectedRoots().includes(root))
+        return canonicalRoot;
+    return insideRuntimeRoot(canonicalRoot, root) ? root : null;
+}
+function hasBroaderBaseline(root, boundary, baselines) {
+    return baselines.some((baseline) => insideRuntimeRoot(baseline, boundary) ||
+        insideRuntimeRoot(baseline, root));
+}
+function supportedNativeNamespace(root) {
+    if (process.platform === "linux")
+        return [
+            "/var/tmp/sevro-native-private",
+            "/private/var/tmp/sevro-native-private",
+        ].includes(root);
+    return (process.platform === "darwin" &&
+        /^\/private\/var\/folders\/[^/]+\/[^/]+\/T\/sevro-native-private$/.test(root));
+}
+/** Codex masks deny ancestors after read mounts; the empty-root policy already hides safe HOME ancestors. */
+function implicitLinuxHomeBoundary(root, readRoots, baselines) {
+    if (!isRuntimeHomeRoot(root))
+        return false;
+    const descendant = readRoots.some((read) => insideRuntimeRoot(root, read));
+    return (descendant &&
+        !baselines.some((baseline) => insideRuntimeRoot(baseline, root)));
+}
+function commandEnvironmentLines(environment = {}, executableReadRoots) {
+    const systemPath = environment.PATH ??
+        "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+    const path = process.platform === "linux"
+        ? [...executableReadRoots, systemPath].join(":")
+        : systemPath;
+    return [
+        `PATH = ${toml(path)}`,
+        ...Object.entries(environment)
+            .filter(([name]) => !["PATH", "HOME", "TMPDIR"].includes(name))
+            .map(([name, value]) => `${toml(name)} = ${toml(value)}`),
+    ];
+}
+function optionalRootLines(root, permission) {
+    return root ? [`${toml(root)} = ${toml(permission)}`] : [];
+}
+function readRootLines(options) {
+    return profileReadRoots(options)
+        .sort()
+        .map((path) => `${toml(path)} = "read"`);
+}
+function profileReadRoots(options) {
+    const roots = [
+        ...options.executableReadRoots,
+        ...(options.runtimeReadRoots ?? []),
+        ...(options.nativeReadRoots ?? []),
+    ];
+    if (options.pluginReadRoot)
+        roots.push(options.pluginReadRoot);
+    return [...new Set(roots)];
+}
+function readRoot(path) {
+    return isAbsolute(path) && path !== "/";
+}
+function optionalReadRoot(path) {
+    return path === undefined || readRoot(path);
+}
+function validProfilePaths(options) {
+    const privatePaths = [
+        options.workspace,
+        options.commandHome,
+        options.commandTemp,
+    ];
+    return (privatePaths.every(isAbsolute) &&
+        validExecutableRoots(options.executableReadRoots) &&
+        optionalReadRoot(options.pluginReadRoot) &&
+        validProtectedRoots(options.protectedRoots));
+}
+function validExecutableRoots(paths) {
+    return paths.length > 0 && paths.every(readRoot);
+}
+function validProtectedRoots(paths) {
+    return paths.length > 0 && paths.every(isAbsolute);
+}
+//# sourceMappingURL=codex-profile.js.map

package/dist/src/hosts/codex-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-profile.js","sourceRoot":"","sources":["codex-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,kBAAkB;AAClD,OAAO,EAAE,YAAY,IAAI,qBAAqB,EAAE,oBAAiB;AACjE,OAAO,EAAE,eAAe,EAAE,2BAAwB;AAClD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAAyB;AACxE,OAAO,EAAE,0BAA0B,EAAE,uCAAoC;AACzE,OAAO,EACL,eAAe,EACf,yBAAyB,GAC1B,sCAAmC;AAEpC,MAAM,wBAAwB,GAAG;IAC/B,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,wBAAwB;CACzB,CAAC;AAEF,SAAS,IAAI,CAAC,KAAa;IACzB,IAAI,eAAe,CAAC,KAAK,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,OActC;IACC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC;IACxB,OAAO;QACL,yBAAyB,IAAI,CAAC,IAAI,CAAC,EAAE;QACrC,2BAA2B;QAC3B,2BAA2B;QAC3B,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC;QACvC,EAAE;QACF,4BAA4B;QAC5B,kBAAkB;QAClB,iCAAiC;QACjC,EAAE;QACF,gCAAgC;QAChC,GAAG,uBAAuB,CACxB,OAAO,CAAC,kBAAkB,EAC1B,OAAO,CAAC,mBAAmB,CAC5B;QACD,UAAU,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;QACrC,YAAY,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;QACvC,eAAe,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,EAAE;QACrD,EAAE;QACF,gBAAgB,IAAI,GAAG;QACvB,wBAAwB;QACxB,EAAE;QACF,gBAAgB,IAAI,cAAc;QAClC,kBAAkB;QAClB,qBAAqB;QACrB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;QACpD,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;aACrD,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAC1C,GAAG,aAAa,CAAC,OAAO,CAAC;QACzB,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CACpC;QACD,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY;QACxC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY;QACxC,GAAG,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC;QACvD,qEAAqE;QACrE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,YAAY;QACpD,EAAE;QACF,gBAAgB,IAAI,iCAAiC;QACrD,eAAe;QACf,EAAE;QACF,gBAAgB,IAAI,WAAW;QAC/B,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,SAA8B;IACvD,OAAO;QACL,YAAY;QACZ,eAAe;QACf,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,SAA8B;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,8BAA8B;QAC9B,6EAA6E;KAC9E,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAqD;IAErD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG;QACnB,GAAG,SAAS;QACZ,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,GAAG,wBAAwB;QAC3B,GAAG,SAAS;QACZ,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACnC,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,WAAW;QACnB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;IACF,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CAAC,yBAAyB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC;QACrD,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC/B,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC;QACtD,CAAC,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAY,EACZ,SAAiB,EACjB,SAAmB;IAEnB,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,0BAA0B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACtD,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAY,EACZ,YAAsB,EACtB,SAAmB;IAEnB,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC;IACxC,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5C,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAClC,CAAC;IACF,OAAO,UAAU,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,aAAqB;IAErB,IAAI,yBAAyB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IACrE,OAAO,iBAAiB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,QAAgB,EAChB,SAAmB;IAEnB,OAAO,SAAS,CAAC,IAAI,CACnB,CAAC,QAAQ,EAAE,EAAE,CACX,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACrC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC9B,OAAO;YACL,+BAA+B;YAC/B,uCAAuC;SACxC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnB,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC7B,kEAAkE,CAAC,IAAI,CACrE,IAAI,CACL,CACF,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,SAAS,yBAAyB,CAChC,IAAY,EACZ,SAAmB,EACnB,SAAmB;IAEnB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3E,OAAO,CACL,UAAU;QACV,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,cAAsC,EAAE,EACxC,mBAA6B;IAE7B,MAAM,UAAU,GACd,WAAW,CAAC,IAAI;QAChB,gEAAgE,CAAC;IACnE,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,CAAC,GAAG,mBAAmB,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,UAAU,CAAC;IACjB,OAAO;QACL,UAAU,IAAI,CAAC,IAAI,CAAC,EAAE;QACtB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;aAC3B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;aAC9D,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAwB,EACxB,UAAkB;IAElB,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CACpB,OAAqD;IAErD,OAAO,gBAAgB,CAAC,OAAO,CAAC;SAC7B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAqD;IAErD,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO,CAAC,mBAAmB;QAC9B,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;KACnC,CAAC;IACF,IAAI,OAAO,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB;IAChD,OAAO,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAqD;IAErD,MAAM,YAAY,GAAG;QACnB,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,WAAW;KACpB,CAAC;IACF,OAAO,CACL,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9B,oBAAoB,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC;QACxC,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAe;IAC3C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe;IAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC","sourcesContent":["import { isAbsolute, join, sep } from \"node:path\";\nimport { minimalRoots as minimalProtectedRoots } from \"../paths\";\nimport { containsControl } from \"../value-guards\";\nimport { insideRuntimeRoot, isRuntimeHomeRoot } from \"../runtime/paths\";\nimport { workspaceBoundaryException } from \"../fixtures/workspace-state\";\nimport {\n  nativeStatePath,\n  nativeStateProtectedRoots,\n} from \"../native-transcript-state\";\n\nconst LINUX_MINIMAL_READ_ROOTS = [\n  \"/bin\",\n  \"/sbin\",\n  \"/usr\",\n  \"/etc\",\n  \"/lib\",\n  \"/lib64\",\n  \"/nix/store\",\n  \"/run/current-system/sw\",\n];\n\nfunction toml(value: string): string {\n  if (containsControl(value))\n    throw new Error(\"Codex profile value contains a control character\");\n  return JSON.stringify(value);\n}\n\n/** Runner-owned Codex command policy; the Codex parent keeps access to auth. */\nexport function codexPermissionProfile(options: {\n  id: string;\n  workspace: string;\n  commandHome: string;\n  commandTemp: string;\n  executableReadRoots: string[];\n  pluginReadRoot?: string;\n  protectedRoots: string[];\n  commandEnvironment?: Record<string, string>;\n  runtimeReadRoots?: string[];\n  nativeReadRoots?: string[];\n  nativeWriteRoots?: string[];\n  runtimeWriteRoot?: string;\n  localHttp?: boolean;\n}): string {\n  if (!/^[a-z][a-z0-9_]*$/.test(options.id))\n    throw new Error(\"invalid Codex permission profile ID\");\n  if (!validProfilePaths(options))\n    throw new Error(\"Codex profile paths must be absolute and protected\");\n  const name = options.id;\n  return [\n    `default_permissions = ${toml(name)}`,\n    'approval_policy = \"never\"',\n    \"allow_login_shell = false\",\n    ...codexFeatureLines(options.localHttp),\n    \"\",\n    \"[shell_environment_policy]\",\n    'inherit = \"none\"',\n    \"ignore_default_excludes = false\",\n    \"\",\n    \"[shell_environment_policy.set]\",\n    ...commandEnvironmentLines(\n      options.commandEnvironment,\n      options.executableReadRoots,\n    ),\n    `HOME = ${toml(options.commandHome)}`,\n    `TMPDIR = ${toml(options.commandTemp)}`,\n    `TMPPREFIX = ${toml(join(options.commandTemp, sep))}`,\n    \"\",\n    `[permissions.${name}]`,\n    'extends = \":workspace\"',\n    \"\",\n    `[permissions.${name}.filesystem]`,\n    '\":root\" = \"deny\"',\n    '\":minimal\" = \"read\"',\n    ...(process.platform === \"linux\"\n      ? []\n      : ['\":tmpdir\" = \"deny\"', '\":slash_tmp\" = \"deny\"']),\n    ...minimalProtectedRoots(profileProtectedRoots(options))\n      .sort()\n      .map((root) => `${toml(root)} = \"deny\"`),\n    ...readRootLines(options),\n    ...(options.nativeWriteRoots ?? []).map(\n      (root) => `${toml(root)} = \"write\"`,\n    ),\n    `${toml(options.commandHome)} = \"write\"`,\n    `${toml(options.commandTemp)} = \"write\"`,\n    ...optionalRootLines(options.runtimeWriteRoot, \"write\"),\n    // Override Codex's metadata carveout only for this isolated fixture.\n    `${toml(join(options.workspace, \".git\"))} = \"write\"`,\n    \"\",\n    `[permissions.${name}.filesystem.\":workspace_roots\"]`,\n    '\".\" = \"write\"',\n    \"\",\n    `[permissions.${name}.network]`,\n    ...networkProfile(options.localHttp),\n    \"\",\n  ].join(\"\\n\");\n}\n\nfunction codexFeatureLines(localHttp: boolean | undefined): string[] {\n  return [\n    \"[features]\",\n    \"hooks = false\",\n    ...(localHttp ? [\"network_proxy = true\"] : []),\n  ];\n}\n\nfunction networkProfile(localHttp: boolean | undefined): string[] {\n  if (!localHttp) return [\"enabled = false\"];\n  return [\n    \"enabled = true\",\n    \"allow_local_binding = true\",\n    \"allow_upstream_proxy = false\",\n    'domains = { \"localhost\" = \"allow\", \"127.0.0.1\" = \"allow\", \"::1\" = \"allow\" }',\n  ];\n}\n\nfunction profileProtectedRoots(\n  options: Parameters<typeof codexPermissionProfile>[0],\n): string[] {\n  const readRoots = profileReadRoots(options);\n  const trustedRoots = [\n    ...readRoots,\n    ...(options.nativeWriteRoots ?? []),\n    ...(options.runtimeWriteRoot ? [options.runtimeWriteRoot] : []),\n  ];\n  const baselines = [\n    ...LINUX_MINIMAL_READ_ROOTS,\n    ...readRoots,\n    ...(options.nativeWriteRoots ?? []),\n    options.workspace,\n    options.commandHome,\n    options.commandTemp,\n    ...(options.runtimeWriteRoot ? [options.runtimeWriteRoot] : []),\n  ];\n  return options.protectedRoots.filter(\n    (root) =>\n      (!implicitLinuxHomeBoundary(root, readRoots, baselines) ||\n        process.platform !== \"linux\") &&\n      !implicitNativeBoundary(root, trustedRoots, baselines) &&\n      !implicitWorkspaceBoundary(root, options.workspace, baselines),\n  );\n}\n\nfunction implicitWorkspaceBoundary(\n  root: string,\n  workspace: string,\n  baselines: string[],\n): boolean {\n  return (\n    process.platform === \"linux\" &&\n    workspaceBoundaryException(root, workspace).length > 0 &&\n    !hasBroaderBaseline(root, root, baselines)\n  );\n}\n\nfunction implicitNativeBoundary(\n  root: string,\n  trustedRoots: string[],\n  baselines: string[],\n): boolean {\n  const canonicalRoot = nativeStatePath();\n  if (!supportedNativeNamespace(canonicalRoot)) return false;\n  const boundary = nativeBoundaryRoot(root, canonicalRoot);\n  if (!boundary) return false;\n  const descendant = trustedRoots.some((read) =>\n    insideRuntimeRoot(boundary, read),\n  );\n  return descendant && !hasBroaderBaseline(root, boundary, baselines);\n}\n\nfunction nativeBoundaryRoot(\n  root: string,\n  canonicalRoot: string,\n): string | null {\n  if (nativeStateProtectedRoots().includes(root)) return canonicalRoot;\n  return insideRuntimeRoot(canonicalRoot, root) ? root : null;\n}\n\nfunction hasBroaderBaseline(\n  root: string,\n  boundary: string,\n  baselines: string[],\n): boolean {\n  return baselines.some(\n    (baseline) =>\n      insideRuntimeRoot(baseline, boundary) ||\n      insideRuntimeRoot(baseline, root),\n  );\n}\n\nfunction supportedNativeNamespace(root: string): boolean {\n  if (process.platform === \"linux\")\n    return [\n      \"/var/tmp/sevro-native-private\",\n      \"/private/var/tmp/sevro-native-private\",\n    ].includes(root);\n  return (\n    process.platform === \"darwin\" &&\n    /^\\/private\\/var\\/folders\\/[^/]+\\/[^/]+\\/T\\/sevro-native-private$/.test(\n      root,\n    )\n  );\n}\n\n/** Codex masks deny ancestors after read mounts; the empty-root policy already hides safe HOME ancestors. */\nfunction implicitLinuxHomeBoundary(\n  root: string,\n  readRoots: string[],\n  baselines: string[],\n): boolean {\n  if (!isRuntimeHomeRoot(root)) return false;\n  const descendant = readRoots.some((read) => insideRuntimeRoot(root, read));\n  return (\n    descendant &&\n    !baselines.some((baseline) => insideRuntimeRoot(baseline, root))\n  );\n}\n\nfunction commandEnvironmentLines(\n  environment: Record<string, string> = {},\n  executableReadRoots: string[],\n): string[] {\n  const systemPath =\n    environment.PATH ??\n    \"/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin\";\n  const path =\n    process.platform === \"linux\"\n      ? [...executableReadRoots, systemPath].join(\":\")\n      : systemPath;\n  return [\n    `PATH = ${toml(path)}`,\n    ...Object.entries(environment)\n      .filter(([name]) => ![\"PATH\", \"HOME\", \"TMPDIR\"].includes(name))\n      .map(([name, value]) => `${toml(name)} = ${toml(value)}`),\n  ];\n}\n\nfunction optionalRootLines(\n  root: string | undefined,\n  permission: string,\n): string[] {\n  return root ? [`${toml(root)} = ${toml(permission)}`] : [];\n}\n\nfunction readRootLines(\n  options: Parameters<typeof codexPermissionProfile>[0],\n): string[] {\n  return profileReadRoots(options)\n    .sort()\n    .map((path) => `${toml(path)} = \"read\"`);\n}\n\nfunction profileReadRoots(\n  options: Parameters<typeof codexPermissionProfile>[0],\n): string[] {\n  const roots = [\n    ...options.executableReadRoots,\n    ...(options.runtimeReadRoots ?? []),\n    ...(options.nativeReadRoots ?? []),\n  ];\n  if (options.pluginReadRoot) roots.push(options.pluginReadRoot);\n  return [...new Set(roots)];\n}\n\nfunction readRoot(path: string): boolean {\n  return isAbsolute(path) && path !== \"/\";\n}\n\nfunction optionalReadRoot(path: string | undefined): boolean {\n  return path === undefined || readRoot(path);\n}\n\nfunction validProfilePaths(\n  options: Parameters<typeof codexPermissionProfile>[0],\n): boolean {\n  const privatePaths = [\n    options.workspace,\n    options.commandHome,\n    options.commandTemp,\n  ];\n  return (\n    privatePaths.every(isAbsolute) &&\n    validExecutableRoots(options.executableReadRoots) &&\n    optionalReadRoot(options.pluginReadRoot) &&\n    validProtectedRoots(options.protectedRoots)\n  );\n}\n\nfunction validExecutableRoots(paths: string[]): boolean {\n  return paths.length > 0 && paths.every(readRoot);\n}\n\nfunction validProtectedRoots(paths: string[]): boolean {\n  return paths.length > 0 && paths.every(isAbsolute);\n}\n"]}

package/dist/src/hosts/codex-session-files.js

@@ -0,0 +1,89 @@
+import { lstat, readFile, readdir, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { isMissingFile } from "../fixtures/tools.js";
+const MAX_SESSION_BYTES = 8 * 1024 * 1024;
+const MAX_SESSION_FILES = 1024;
+const THREAD_ID = /^[A-Za-z0-9._-]{1,128}$/;
+async function sessionsRootStatus(root) {
+    try {
+        const entry = await lstat(root);
+        return entry.isDirectory() && !entry.isSymbolicLink() ? "valid" : "partial";
+    }
+    catch (error) {
+        return isMissingFile(error) ? "unavailable" : "partial";
+    }
+}
+class SessionSearch {
+    suffix;
+    pending;
+    matches = [];
+    visited = 0;
+    constructor(root, suffix) {
+        this.suffix = suffix;
+        this.pending = [root];
+    }
+    async run() {
+        while (this.pending.length) {
+            const directory = this.pending.pop();
+            if (directory === undefined)
+                break;
+            try {
+                const status = await this.visitDirectory(directory);
+                if (status)
+                    return { status };
+            }
+            catch {
+                return { status: "partial" };
+            }
+        }
+        const [path] = this.matches;
+        return this.location(path);
+    }
+    location(path) {
+        return this.matches.length === 1 && path !== undefined
+            ? { status: "found", path }
+            : { status: "unavailable" };
+    }
+    async visitDirectory(directory) {
+        const entries = await readdir(directory, { withFileTypes: true });
+        for (const entry of entries) {
+            const status = this.visitEntry(directory, entry);
+            if (status)
+                return status;
+        }
+        return undefined;
+    }
+    visitEntry(directory, entry) {
+        this.visited++;
+        if (this.visited > MAX_SESSION_FILES || entry.isSymbolicLink())
+            return "partial";
+        return this.collectCandidate(directory, entry);
+    }
+    collectCandidate(directory, entry) {
+        const path = join(directory, entry.name);
+        if (entry.isDirectory())
+            this.pending.push(path);
+        else if (entry.isFile() && entry.name.endsWith(this.suffix))
+            this.matches.push(path);
+        return this.matches.length > 1 ? "ambiguous" : undefined;
+    }
+}
+/** Locate exactly one original thread while refusing symlinks and bounded tree overflow. */
+export async function locateNativeSession(home, threadId) {
+    if (!THREAD_ID.test(threadId))
+        return { status: "partial" };
+    const root = join(home, "sessions");
+    const status = await sessionsRootStatus(root);
+    if (status !== "valid")
+        return { status };
+    return new SessionSearch(root, `-${threadId}.jsonl`).run();
+}
+export async function readNativeSession(path) {
+    if ((await stat(path)).size > MAX_SESSION_BYTES)
+        return null;
+    const bytes = await readFile(path);
+    if (bytes.byteLength > MAX_SESSION_BYTES)
+        return null;
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+//# sourceMappingURL=codex-session-files.js.map

package/dist/src/hosts/codex-session-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-session-files.js","sourceRoot":"","sources":["codex-session-files.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB;AAClE,OAAO,EAAE,IAAI,EAAE,kBAAkB;AACjC,OAAO,EAAE,aAAa,EAAE,6BAA0B;AAElD,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAK5C,KAAK,UAAU,kBAAkB,CAC/B,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,aAAa;IAMP;IALF,OAAO,CAAW;IAClB,OAAO,GAAa,EAAE,CAAC;IACvB,OAAO,GAAG,CAAC,CAAC;IACpB,YACE,IAAY,EACJ,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAEtB,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,GAAG;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACrC,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,MAAM;oBAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,QAAQ,CAAC,IAAwB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS;YACpD,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,SAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACjD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,UAAU,CAChB,SAAiB,EACjB,KAAa;QAEb,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,IAAI,CAAC,OAAO,GAAG,iBAAiB,IAAI,KAAK,CAAC,cAAc,EAAE;YAC5D,OAAO,SAAS,CAAC;QACnB,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAEO,gBAAgB,CACtB,SAAiB,EACjB,KAAa;QAEb,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC5C,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,QAAgB;IAEhB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC1C,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,UAAU,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import type { Dirent } from \"node:fs\";\nimport { lstat, readFile, readdir, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { isMissingFile } from \"../fixtures/tools\";\n\nconst MAX_SESSION_BYTES = 8 * 1024 * 1024;\nconst MAX_SESSION_FILES = 1024;\nconst THREAD_ID = /^[A-Za-z0-9._-]{1,128}$/;\ntype SearchStatus = \"partial\" | \"unavailable\" | \"ambiguous\";\ntype SessionLocation =\n  { status: SearchStatus } | { status: \"found\"; path: string };\n\nasync function sessionsRootStatus(\n  root: string,\n): Promise<\"valid\" | \"partial\" | \"unavailable\"> {\n  try {\n    const entry = await lstat(root);\n    return entry.isDirectory() && !entry.isSymbolicLink() ? \"valid\" : \"partial\";\n  } catch (error) {\n    return isMissingFile(error) ? \"unavailable\" : \"partial\";\n  }\n}\n\nclass SessionSearch {\n  private pending: string[];\n  private matches: string[] = [];\n  private visited = 0;\n  constructor(\n    root: string,\n    private suffix: string,\n  ) {\n    this.pending = [root];\n  }\n\n  async run(): Promise<SessionLocation> {\n    while (this.pending.length) {\n      const directory = this.pending.pop();\n      if (directory === undefined) break;\n      try {\n        const status = await this.visitDirectory(directory);\n        if (status) return { status };\n      } catch {\n        return { status: \"partial\" };\n      }\n    }\n    const [path] = this.matches;\n    return this.location(path);\n  }\n\n  private location(path: string | undefined): SessionLocation {\n    return this.matches.length === 1 && path !== undefined\n      ? { status: \"found\", path }\n      : { status: \"unavailable\" };\n  }\n\n  private async visitDirectory(\n    directory: string,\n  ): Promise<SearchStatus | undefined> {\n    const entries = await readdir(directory, { withFileTypes: true });\n    for (const entry of entries) {\n      const status = this.visitEntry(directory, entry);\n      if (status) return status;\n    }\n    return undefined;\n  }\n\n  private visitEntry(\n    directory: string,\n    entry: Dirent,\n  ): SearchStatus | undefined {\n    this.visited++;\n    if (this.visited > MAX_SESSION_FILES || entry.isSymbolicLink())\n      return \"partial\";\n    return this.collectCandidate(directory, entry);\n  }\n\n  private collectCandidate(\n    directory: string,\n    entry: Dirent,\n  ): SearchStatus | undefined {\n    const path = join(directory, entry.name);\n    if (entry.isDirectory()) this.pending.push(path);\n    else if (entry.isFile() && entry.name.endsWith(this.suffix))\n      this.matches.push(path);\n    return this.matches.length > 1 ? \"ambiguous\" : undefined;\n  }\n}\n\n/** Locate exactly one original thread while refusing symlinks and bounded tree overflow. */\nexport async function locateNativeSession(\n  home: string,\n  threadId: string,\n): Promise<SessionLocation> {\n  if (!THREAD_ID.test(threadId)) return { status: \"partial\" };\n  const root = join(home, \"sessions\");\n  const status = await sessionsRootStatus(root);\n  if (status !== \"valid\") return { status };\n  return new SessionSearch(root, `-${threadId}.jsonl`).run();\n}\n\nexport async function readNativeSession(path: string): Promise<string | null> {\n  if ((await stat(path)).size > MAX_SESSION_BYTES) return null;\n  const bytes = await readFile(path);\n  if (bytes.byteLength > MAX_SESSION_BYTES) return null;\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n}\n"]}

package/dist/src/hosts/codex-state.js

@@ -0,0 +1,310 @@
+import { runtimeLocalHttpEnabled, runtimeSeedSources } from "../runtime/config.js";
+import { shellQuote } from "../shell.js";
+import { candidateArtifactEnvironment, candidateArtifactReadRoots, } from "../candidate-artifacts.js";
+import { codexStateEnabled, retainCandidateCodexState, } from "../candidate-codex-state.js";
+import { randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import { isMissingFile } from "../fixtures/tools.js";
+import { cp, lstat, mkdir, readFile, realpath, rm, stat, symlink, writeFile, } from "node:fs/promises";
+import { delimiter, dirname, join, sep } from "node:path";
+import { candidateTranscriptEnvironment, candidateTranscriptRoots, } from "../native-transcripts.js";
+import { prepareHookMounts } from "../runtime/hooks.js";
+import { requireNativeHookRoots } from "../native-transcript-state.js";
+import { requireRuntimeReadRoots, runtimeExecutableProtection, } from "../runtime/paths.js";
+import { prepareRuntimeState } from "../runtime/state.js";
+import { sharedCacheDenyRoots, sharedCacheRoots, } from "../runtime/shared-cache.js";
+import { codexPermissionProfile } from "./codex-profile.js";
+import { evaluationProtectedRoots } from "./isolation-roots.js";
+const MAX_AUTH_BYTES = 1024 * 1024;
+async function copyAuth(source, target) {
+    let bytes;
+    try {
+        if ((await stat(source)).size > MAX_AUTH_BYTES)
+            throw new Error("Codex auth file exceeds the size limit");
+        bytes = await readFile(source);
+    }
+    catch (error) {
+        throw new Error("Codex auth file is unreadable or oversized", {
+            cause: error,
+        });
+    }
+    if (bytes.byteLength > MAX_AUTH_BYTES)
+        throw new Error("Codex auth file exceeds the size limit");
+    await writeFile(target, bytes, { flag: "wx", mode: 0o600 });
+}
+export async function codexHookMounts(request, state, installedPluginRoots) {
+    const hooks = await prepareHookMounts({
+        workspace: request.workspace,
+        stateRoot: state.stateRoot,
+        privateRoot: state.codexHome,
+        pluginRoots: installedPluginRoots,
+        protectedRoots: state.protectedRoots,
+        policy: request.runtimePolicy ?? {
+            format: "sevro.runtime.v1",
+            environment: {},
+            readOnlyRoots: [],
+        },
+    });
+    for (const [index, root] of installedPluginRoots.entries()) {
+        const curated = hooks.directories[index];
+        if (!curated)
+            throw new Error("Codex hook projection is incomplete");
+        await rm(root, { recursive: true });
+        await cp(curated, root, { recursive: true });
+    }
+    await grantCodexHookReads(state, hooks.directories);
+    return hooks;
+}
+/** Hooks advertise paths relative to these curated copies, not the install cache. */
+async function grantCodexHookReads(state, roots) {
+    if (roots.length === 0)
+        return;
+    await requireNativeHookRoots(roots, state.codexHome);
+    const path = join(state.codexHome, "config.toml");
+    const config = await readFile(path, "utf8");
+    const header = `[permissions.${state.profileId}.filesystem]\n`;
+    const grants = roots
+        .map((root) => `${JSON.stringify(root)} = "read"\n`)
+        .join("");
+    await writeFile(path, config.replace(header, header + grants), {
+        mode: 0o600,
+    });
+}
+async function privateCodexDirectories(stateRoot) {
+    const codexHome = join(stateRoot, "codex-home"), parentHome = join(stateRoot, "home"), parentTemp = join(stateRoot, "tmp"), commandHome = join(stateRoot, "command-home"), commandTemp = join(stateRoot, "command-tmp");
+    await Promise.all([codexHome, parentHome, parentTemp, commandHome, commandTemp].map((path) => mkdir(path, { mode: 0o700 })));
+    if (process.platform === "linux")
+        await mkdir(join(codexHome, "tmp", "arg0"), {
+            recursive: true,
+            mode: 0o700,
+        });
+    return {
+        codexHome,
+        parentHome,
+        parentTemp,
+        commandHome,
+        commandTemp,
+        pluginCacheRoot: join(codexHome, "plugins", "cache"),
+    };
+}
+function requireUnprotectedExecutables(readRoots, protectedRoots) {
+    if (readRoots.some((readRoot) => protectedRoots.some((root) => readRoot === root || readRoot.startsWith(`${root}${sep}`))))
+        throw new Error("Codex executable resides inside a protected root");
+}
+function concurrencyConfiguration(limit) {
+    return limit === null
+        ? ""
+        : `\n[agents]\nmax_concurrent_threads_per_session = ${limit}\n`;
+}
+async function writeCodexProfile(paths, profileId, request, readRoots, protectedRoots, limit, commandEnvironment = request.runtimePolicy?.environment, runtimeWriteRoot, writableCacheRoots) {
+    const profile = codexPermissionProfile({
+        localHttp: runtimeLocalHttpEnabled(request.runtimePolicy, request.runtimeRole ?? "candidate"),
+        commandEnvironment: codexProfileEnvironment(request, paths, commandEnvironment),
+        runtimeWriteRoot,
+        runtimeReadRoots: request.runtimePolicy?.readOnlyRoots,
+        nativeReadRoots: codexNativeReadRoots(request, paths.codexHome),
+        nativeWriteRoots: [
+            ...codexStateWriteRoots(request, paths),
+            ...writableCacheRoots,
+        ],
+        id: profileId,
+        workspace: request.workspace,
+        commandHome: paths.commandHome,
+        commandTemp: paths.commandTemp,
+        executableReadRoots: readRoots,
+        ...codexPluginReadRoot(request, paths.pluginCacheRoot),
+        protectedRoots,
+    });
+    await writeFile(join(paths.codexHome, "config.toml"), profile +
+        concurrencyConfiguration(limit) +
+        fixtureTrustConfiguration(request), { flag: "wx", mode: 0o600 });
+}
+function fixtureTrustConfiguration(request) {
+    return `\n[projects.${JSON.stringify(request.workspace)}]\ntrust_level = "untrusted"\n`;
+}
+function codexProfileEnvironment(request, paths, environment) {
+    return {
+        ...codexCommandEnvironment(request, environment),
+        ...codexTranscriptEnvironment(request, paths.codexHome),
+        ...candidateTranscriptEnvironment(request.candidateTranscriptRoot),
+        ...candidateArtifactEnvironment(request.candidateArtifactRoots),
+        ...(request.runtimePolicy?.codexState === true
+            ? {
+                SEVRO_CODEX_AGENT_SKILLS: join(paths.parentHome, ".agents", "skills"),
+            }
+            : {}),
+    };
+}
+function codexTranscriptEnvironment(request, home) {
+    return {
+        ...(request.runtimePolicy?.codexState === true ? { CODEX_HOME: home } : {}),
+        ...(request.runtimePolicy?.nativeTranscripts === true
+            ? {
+                CODEX_HOME: home,
+                SEVRO_NATIVE_TRANSCRIPT_ROOT: join(home, "sessions"),
+            }
+            : {}),
+    };
+}
+function codexNativeReadRoots(request, home) {
+    return [
+        ...linuxArg0ReadRoots(home),
+        ...(request.runtimePolicy?.codexState === true
+            ? [join(home, "config.toml"), join(home, "skills", ".system")]
+            : []),
+        ...codexTranscriptRoots(request, home),
+        ...candidateTranscriptRoots(request.candidateTranscriptRoot),
+        ...candidateArtifactReadRoots(request.candidateArtifactRoots),
+    ];
+}
+function codexTranscriptRoots(request, home) {
+    return request.runtimePolicy?.nativeTranscripts === true
+        ? [join(home, "sessions")]
+        : [];
+}
+function linuxArg0ReadRoots(codexHome) {
+    return process.platform === "linux" ? [join(codexHome, "tmp", "arg0")] : [];
+}
+function codexPluginReadRoot(request, root) {
+    return request.codexMarketplace ? { pluginReadRoot: root } : {};
+}
+function codexHelperBinary(options, sandboxBinary) {
+    const sibling = join(dirname(options.binary), "codex-linux-sandbox");
+    return (options.sandboxBinary ?? (existsSync(sibling) ? sibling : sandboxBinary));
+}
+function codexCommandEnvironment(request, environment) {
+    if (!environment)
+        return undefined;
+    const path = environment.PATH ??
+        "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+    return {
+        ...environment,
+        PATH: [request.fixtureBinDir, path].filter(Boolean).join(delimiter),
+    };
+}
+async function fixtureShellRoot(request, parentHome) {
+    const root = join(request.workspace, ".git", "sevro-shell");
+    if (request.fixtureBinDir) {
+        await mkdir(root, { mode: 0o700 });
+        await writeFile(process.platform === "linux"
+            ? join(parentHome, ".bash_profile")
+            : join(root, ".zprofile"), `export PATH=${shellQuote(request.fixtureBinDir)}:"$PATH"\n`, { flag: "wx", mode: 0o600 });
+    }
+    return root;
+}
+function codexPath(fixtureBin) {
+    const path = process.env.PATH ?? "/usr/bin:/bin";
+    return fixtureBin ? `${fixtureBin}${delimiter}${path}` : path;
+}
+function codexEnvironment(paths, request, shellRoot) {
+    return {
+        ...request.runtimePolicy?.environment,
+        PATH: declaredCodexPath(request),
+        LANG: process.env.LANG ?? "C",
+        HOME: paths.parentHome,
+        TMPDIR: paths.parentTemp,
+        CODEX_HOME: paths.codexHome,
+        NO_COLOR: "1",
+        ...(request.fixtureBinDir && process.platform === "darwin"
+            ? { ZDOTDIR: shellRoot }
+            : {}),
+    };
+}
+function declaredCodexPath(request) {
+    return (request.runtimePolicy?.environment.PATH ?? codexPath(request.fixtureBinDir));
+}
+function codexSeedSources(request) {
+    return runtimeSeedSources(request.runtimePolicy);
+}
+async function codexRuntime(request, paths, stateRoot) {
+    if (!request.runtimePolicy)
+        return undefined;
+    const runtime = await prepareRuntimeState(request.workspace, request.runtimePolicy, request.runtimeRole ?? "candidate", request.candidateRuntimeRoot ?? join(stateRoot, "runtime"));
+    paths.commandHome = runtime.home;
+    paths.commandTemp = runtime.temp;
+    return runtime;
+}
+function applyCodexRuntime(runtime, env, paths) {
+    if (runtime)
+        Object.assign(env, runtime.environment, {
+            HOME: paths.parentHome,
+            TMPDIR: paths.parentTemp,
+        });
+}
+function codexRuntimeProfile(runtime) {
+    return {
+        environment: runtime?.environment,
+        root: runtime?.root,
+        writableCacheRoots: runtime?.writableCacheRoots ?? [],
+    };
+}
+export async function prepareCodexState(stateRoot, options, limit, request, helperRoot) {
+    await requireIsolatedGitMetadata(request.workspace);
+    const paths = await privateCodexDirectories(stateRoot);
+    const runtime = await codexRuntime(request, paths, stateRoot);
+    await copyAuth(options.authFile, join(paths.codexHome, "auth.json"));
+    const protectedRoots = await evaluationProtectedRoots({
+        workspace: request.workspace,
+        projectRoot: options.projectRoot,
+        resultsRoot: options.resultsRoot,
+        additionalRoots: [
+            ...options.additionalProtectedRoots,
+            ...(process.platform === "linux" ? [] : [stateRoot]),
+            ...codexSeedSources(request),
+        ],
+    });
+    const sandboxBinary = options.sandboxBinary ?? options.binary;
+    const helperBinary = codexHelperBinary(options, sandboxBinary);
+    if (helperRoot)
+        await symlink(helperBinary, join(helperRoot, "codex-linux-sandbox"));
+    const readRoots = await Promise.all([options.binary, sandboxBinary, helperBinary].flatMap((binary) => [
+        realpath(dirname(binary)),
+        realpath(binary).then(dirname),
+    ]));
+    if (helperRoot)
+        readRoots.push(helperRoot);
+    requireCodexRuntimeReadRoots(request, protectedRoots);
+    await sharedCacheRoots(request.runtimePolicy, request.runtimeRole, protectedRoots);
+    protectedRoots.push(...sharedCacheDenyRoots(request.runtimePolicy, request.runtimeRole));
+    requireUnprotectedExecutables(readRoots, runtimeExecutableProtection(readRoots, protectedRoots, Boolean(request.runtimePolicy)));
+    const profileId = `sevro_${randomUUID().replaceAll("-", "")}`;
+    const runtimeProfile = codexRuntimeProfile(runtime);
+    await writeCodexProfile(paths, profileId, request, readRoots, protectedRoots, limit, runtimeProfile.environment, runtimeProfile.root, runtimeProfile.writableCacheRoots);
+    const shellRoot = await fixtureShellRoot(request, paths.parentHome);
+    const env = codexEnvironment(paths, request, shellRoot);
+    applyCodexRuntime(runtime, env, paths);
+    await prepareCodexStateEvidence(request, stateRoot, paths);
+    return { ...paths, stateRoot, sandboxBinary, profileId, env, protectedRoots };
+}
+function codexStateWriteRoots(request, paths) {
+    return codexStateEnabled(request.runtimePolicy)
+        ? [
+            join(paths.codexHome, "skills"),
+            join(paths.parentHome, ".agents", "skills"),
+            join(paths.commandHome, ".agents", "skills"),
+            join(paths.commandHome, ".codex", "skills"),
+        ]
+        : [];
+}
+async function prepareCodexStateEvidence(request, stateRoot, paths) {
+    if (!codexStateEnabled(request.runtimePolicy))
+        return;
+    const skillRoots = codexStateWriteRoots(request, paths);
+    await Promise.all(skillRoots.map((root) => mkdir(root, { recursive: true, mode: 0o700 })));
+    await mkdir(join(paths.codexHome, "skills", ".system"), { mode: 0o700 });
+    await retainCandidateCodexState(request.candidateRuntimeRoot, stateRoot, paths);
+}
+async function requireIsolatedGitMetadata(workspace) {
+    try {
+        if (!(await lstat(join(workspace, ".git"))).isDirectory())
+            throw new Error("Codex Git metadata must be an isolated directory");
+    }
+    catch (cause) {
+        if (!isMissingFile(cause))
+            throw cause;
+    }
+}
+function requireCodexRuntimeReadRoots(request, protectedRoots) {
+    requireRuntimeReadRoots(request.runtimePolicy?.readOnlyRoots ?? [], protectedRoots);
+}
+//# sourceMappingURL=codex-state.js.map