@bridge4dev/runner 0.65.1 → 0.67.0

package/dist/adapters/codex.d.ts

@@ -1,6 +1,24 @@
 import { type CodexHome } from './codex-home.js';
 import { AppServerClient, type ServerRequest } from './codex-protocol.js';
 import { type AgentAdapter, type AgentQuestion, type AgentSession, type EffortOption, type SessionSpec } from './types.js';
+/** One entry of `/`, as `writableRootsFor` needs it. */
+export interface RootEntry {
+    path: string;
+    /** Where a link leads; null when it leads nowhere. */
+    realPath: string | null;
+    isDirectory: boolean;
+}
+/** Lists `/`; throws when it cannot. Replaced only by tests. */
+export type RootLister = () => RootEntry[];
+/**
+ * The top-level directories a widened sandbox may write to, or null when `/`
+ * could not be read.
+ *
+ * Links are followed to where they lead and counted once (`/bin` → `/usr/bin`
+ * adds nothing `/usr` does not); a directory inside another root is dropped for
+ * the same reason; files (a swap file) and dangling links are skipped.
+ */
+export declare function topLevelWritableRoots(listRoot?: RootLister): string[] | null;
 export interface CodexAdapterDeps {
     /** Injected in tests to drive a scripted app-server. */
     spawnClient?: (options: {
@@ -28,11 +46,15 @@ export interface CodexAdapterDeps {
     repairHome?: () => CodexHome;
     /**
      * How this runner's CODEX_HOME is authenticated (`[codex] auth` in
-     * config.toml). Carried here because every repair has to honour it — a
-     * repair that defaults to `link` would undo an owner's decision to keep the
-     * runner's credential separate.
+     * config.toml) – ONLY when the owner wrote it. Every repair honours it, and a
+     * repair that defaulted to `link` would undo both an owner's decision to keep
+     * the runner's credential separate and a switch to a saved login (#422 S4 item
+     * 2). Production leaves it unset: the daemon records the configured mode once
+     * (`configureCodexAuth`), and the home reads it from there.
      */
     authMode?: 'link' | 'own';
+    /** What `/` holds, for the widened sandbox roots – a test seam (`codex-auto-dev-null`). */
+    listRoot?: RootLister;
     /** #382: how often live helpers are re-checked against Codex – a test seam. */
     subagentReconcileMs?: number;
     /** #382: how long a just-started helper's `idle` is disbelieved – a test seam. */

package/dist/adapters/codex.js

@@ -1,9 +1,12 @@
+import fs from 'node:fs';
+import path from 'node:path';
 import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
 import { evaluateToolUse, maskSecrets, maskString, } from '../policy.js';
 import { memoryDeathSentence, sessionMemoryEnv, sessionMemoryPromptLine } from '../session-cage.js';
 import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
+import { codexSessionAccount, noteCodexSessionAccount, noteCodexUsage, releaseCodexSessionAccount, } from '../codex-accounts.js';
 import { AppServerClient, asRecord, num, RpcError, RpcTimeoutError, str, } from './codex-protocol.js';
 import { truncate } from './claude.js';
 import { AgentTaskTray } from './agent-tasks.js';
@@ -87,11 +90,79 @@ const MODE_POLICY = {
  *
  * Read on every turn rather than captured at launch, because the setting can be
  * switched while the session runs.
+ *
+ * **Never `/` itself** (gotcha 541, plan `codex-auto-dev-null`). Codex mounts a
+ * writable root without devices, and `/` laid over its own `/dev` left
+ * `/dev/null` visible but unopenable: every `bash -lc` printed «Permission
+ * denied» and `git status` exited 128. The widened roots are the machine's real
+ * top-level directories instead, minus the kernel's own (`/dev`, `/proc`,
+ * `/sys`) – checked on codex-cli 0.154.0 through `command/exec`: `/dev/null`
+ * opens, `git status` passes, a write outside the project is allowed, and, unlike
+ * `/`, a list of directories leaves no empty `.git`/`.codex`/`.agents` behind
+ * (17.09.2026, on throwaway folders – never on this production host's `/`).
  */
-function writableRootsFor(spec) {
+function writableRootsFor(spec, listRoot = listRootEntries) {
     if (spec.trustMode === 'STRICT')
         return [spec.cwd];
-    return spec.gitPolicy?.agentAllowOutsideFolder === true ? ['/'] : [spec.cwd];
+    if (spec.gitPolicy?.agentAllowOutsideFolder !== true)
+        return [spec.cwd];
+    const roots = topLevelWritableRoots(listRoot);
+    if (roots === null || roots.length === 0) {
+        // Unknown means confined (ADR 0007, «polarity»): a step outside asks, as it
+        // did before the permission existed.
+        return [spec.cwd];
+    }
+    return roots;
+}
+/** The kernel's own file systems – never a place a sandbox should bind over. */
+const NEVER_WRITABLE_ROOTS = ['/dev', '/proc', '/sys'];
+function listRootEntries() {
+    // `withFileTypes`, so a top-level entry is judged by what `readdir` already
+    // knows. A `stat` per entry would reach INTO every mount point, and a dead
+    // network mount at the top level would then block the daemon's only thread on
+    // every turn (found by the independent check of S4). Only a symbolic link is
+    // resolved, and those are few (`/bin`, `/lib`, …).
+    return fs.readdirSync('/', { withFileTypes: true }).map((entry) => {
+        const full = path.join('/', entry.name);
+        if (!entry.isSymbolicLink()) {
+            return { path: full, realPath: full, isDirectory: entry.isDirectory() };
+        }
+        try {
+            const realPath = fs.realpathSync(full);
+            return { path: full, realPath, isDirectory: fs.statSync(realPath).isDirectory() };
+        }
+        catch {
+            return { path: full, realPath: null, isDirectory: false };
+        }
+    });
+}
+/**
+ * The top-level directories a widened sandbox may write to, or null when `/`
+ * could not be read.
+ *
+ * Links are followed to where they lead and counted once (`/bin` → `/usr/bin`
+ * adds nothing `/usr` does not); a directory inside another root is dropped for
+ * the same reason; files (a swap file) and dangling links are skipped.
+ */
+export function topLevelWritableRoots(listRoot = listRootEntries) {
+    let entries;
+    try {
+        entries = listRoot();
+    }
+    catch (error) {
+        log.warn('codex: could not read the top-level folders – the sandbox stays on the project folder', {
+            error: String(error).slice(0, 200),
+        });
+        return null;
+    }
+    const kernel = (dir) => NEVER_WRITABLE_ROOTS.some((root) => dir === root || dir.startsWith(`${root}/`));
+    const unique = [
+        ...new Set(entries
+            .filter((entry) => entry.isDirectory && entry.realPath !== null)
+            .map((entry) => path.resolve(entry.realPath))
+            .filter((dir) => dir !== '/' && !kernel(dir))),
+    ].sort();
+    return unique.filter((dir) => !unique.some((other) => other !== dir && dir.startsWith(`${other}/`)));
 }
 /**
  * DevBridge's own rules — composed per session since session 18, and kept
@@ -214,6 +285,15 @@ class CodexSession {
     queuedInput = [];
     /** Null when the home was injected — an injected home is the whole truth. */
     repairHome;
+    /**
+     * The login this process started under (#422 S4), kept to its end: the machine
+     * may be switched while it runs, and its limits, its card and a refusal it meets
+     * all belong to THIS account (R14). Codex itself keeps a running session on the
+     * account it started with – it will not refresh into another account's file.
+     */
+    account;
+    accountId;
+    listRoot;
     /** Open elicitations, oldest first — Codex may have several in flight. */
     questions = new Map();
     threadId = null;
@@ -279,6 +359,12 @@ class CodexSession {
         this.model = spec.model;
         this.effort = spec.effort;
         this.repairHome = deps.repairHome ?? (deps.codexHome ? null : repairCodexAuth);
+        this.listRoot = deps.listRoot;
+        this.account = codexSessionAccount(home);
+        this.accountId = this.account.id;
+        // Released in `finish`, and only by THIS session: «forget» refuses a login a
+        // live process refreshes into.
+        noteCodexSessionAccount(spec.sessionId, this.accountId, this);
         const wiring = {
             // The cage's two numbers ride along (#398 S5). Built here rather than
             // inside `scrubbedEnv`, which has no access to the session — and merged
@@ -346,6 +432,13 @@ class CodexSession {
                 throw new Error(`codex is using an unexpected CODEX_HOME (${reportedHome ?? 'not reported'}) — refusing to start the session`);
             }
             this.client.notify('initialized', {});
+            // The app-server reads `auth.json` while it starts, so the login it ended
+            // up with is the one the link points at NOW, not the one this object read
+            // before the process existed. A switch in that window is rare and would
+            // otherwise put the previous account's name on this session's card and its
+            // limits (found by the independent check of S4). The row it is noted under
+            // moves with it, so «forget» refuses the right one.
+            this.rereadAccount();
             // The helper set is per PROCESS (#113, #382): a session relaunched after a
             // runner restart must not go on showing the helpers of its previous life,
             // and nothing else would say so until the next one starts or ends.
@@ -675,7 +768,7 @@ class CodexSession {
             input: [{ type: 'text', text, text_elements: [] }],
             approvalPolicy: policy.approvalPolicy,
             // #418: the roots live here and only here — see `writableRootsFor`.
-            sandboxPolicy: sandboxPolicyFor(policy.sandbox, this.spec),
+            sandboxPolicy: sandboxPolicyFor(policy.sandbox, this.spec, this.listRoot),
             ...(this.model ? { model: this.model } : {}),
             // "Override the reasoning effort for this turn and subsequent turns" —
             // the same sticky-override channel the model uses (there is still no
@@ -1835,6 +1928,13 @@ class CodexSession {
         this.emitRateLimits();
     }
     emitRateLimits(blocked = null) {
+        // Whose figures these are (#422 §8): the subscription this session started
+        // under. Codex reports the windows of the account its process is signed in
+        // with, and that is the account captured at the start – so the signature is
+        // true for the whole life of the session. No key (an API-key login) – no
+        // signature, and the panel draws as before #422 (R12).
+        const orgId = this.account.orgId;
+        noteCodexUsage(orgId, this.rateLimitWindows);
         // An empty snapshot is «no plan», not «nothing happened»: Codex sends this
         // for API-key accounts too, and the popup has to be able to say so.
         this.emit({
@@ -1845,6 +1945,7 @@ class CodexSession {
                 planType: this.ratePlanType,
                 measuredAt: new Date().toISOString(),
                 windows: this.rateLimitWindows,
+                ...(orgId ? { orgId } : {}),
             },
         });
     }
@@ -2194,6 +2295,27 @@ class CodexSession {
             this.capabilitiesInFlight = false;
         });
     }
+    /** Who the home belongs to now – after the app-server has read its credential. */
+    rereadAccount() {
+        if (!this.repairHome)
+            return;
+        try {
+            const now = codexSessionAccount(this.repairHome());
+            if (now.id === this.account.id)
+                return;
+            log.info('codex: the machine changed its Codex login while this session was starting', {
+                sessionId: this.spec.sessionId,
+                from: this.account.id,
+                to: now.id,
+            });
+            this.account = now;
+            this.accountId = now.id;
+            noteCodexSessionAccount(this.spec.sessionId, now.id, this);
+        }
+        catch (error) {
+            log.warn('codex: could not re-read the account after start', { error: describe(error) });
+        }
+    }
     async publishCapabilities() {
         // Every probe carries its own catch: an unknown method on a newer or older
         // codex must degrade a picker, not kill the session.
@@ -2218,7 +2340,7 @@ class CodexSession {
             currentMode: this.mode,
             ...(currentModel ? { currentModel } : {}),
             ...(currentEffort ? { currentEffort } : {}),
-            ...(account ? { account } : {}),
+            account: this.sessionAccountCard(account),
             mcpServers,
             interrupt: true,
         };
@@ -2358,6 +2480,21 @@ class CodexSession {
         }
         return options;
     }
+    /**
+     * The card's account: what the live process says about itself (`account/read`),
+     * under the row and the subscription the session started with (#422 §8) – the
+     * `id` a «forget» is refused for, the `orgId` the limits panel matches against.
+     */
+    sessionAccountCard(live) {
+        const plan = live?.plan ?? (this.account.plan ? `ChatGPT ${this.account.plan}` : undefined);
+        const email = live?.email ?? this.account.email;
+        return {
+            id: this.account.id,
+            ...(email ? { email } : {}),
+            ...(plan ? { plan } : {}),
+            ...(this.account.orgId ? { orgId: this.account.orgId } : {}),
+        };
+    }
     async readAccount() {
         const result = asRecord(await this.client.request('account/read', {}, 15_000));
         const account = asRecord(result['account']);
@@ -2505,6 +2642,7 @@ class CodexSession {
         return home.auth === 'missing' ? 'missing' : 'expired';
     }
     finish() {
+        releaseCodexSessionAccount(this.spec.sessionId, this);
         this.stopped = true;
         this.clearLimitSettle();
         this.subagents.close();
@@ -2514,7 +2652,7 @@ class CodexSession {
 }
 class ResumeFailed extends Error {
 }
-function sandboxPolicyFor(mode, spec) {
+function sandboxPolicyFor(mode, spec, listRoot) {
     // turn/start takes the structured SandboxPolicy, while thread/start takes the
     // CLI-style SandboxMode string. Same intent, two shapes — and only this one
     // can name the writable roots, which is why #418 lives here.
@@ -2526,7 +2664,7 @@ function sandboxPolicyFor(mode, spec) {
         default:
             return {
                 type: 'workspaceWrite',
-                writableRoots: writableRootsFor(spec),
+                writableRoots: writableRootsFor(spec, listRoot),
                 // Unchanged by #418, on purpose: the permission is about the file
                 // system, and letting the network out with it would be a second
                 // boundary nobody asked to move. A network command still fails in the
@@ -2796,11 +2934,11 @@ export class CodexAdapter {
         // Re-assert rather than reuse: `repairCodexAuth` is a couple of lstat calls
         // and it puts a credential link back if something removed it since boot.
         //
-        // The configured mode has to travel with it. Repairing with the default
-        // would silently re-link the host user's credential into a home the owner
-        // explicitly asked to keep isolated — turning off a security control by
-        // accident.
-        const repair = () => repairCodexAuth({ auth: this.deps.authMode ?? 'link' });
+        // The configured mode has to travel with it – and only a configured one.
+        // Repairing with a default would silently re-link the host user's credential
+        // into a home the owner explicitly asked to keep isolated, and undo a switch
+        // to a saved login at every session start (#422 S4 item 2).
+        const repair = () => repairCodexAuth(this.deps.authMode ? { auth: this.deps.authMode } : {});
         const home = this.deps.codexHome ?? repair();
         return new CodexSession(spec, home, {
             ...this.deps,

package/dist/adapters/types.d.ts

@@ -87,9 +87,17 @@ export interface CommandOption {
     argumentHint?: string;
 }
 export interface AgentAccountInfo {
+    /**
+     * Which of the machine's accounts THIS session started under (#422 §8) –
+     * `machine` or a saved account's id. Kept to the session's end: switching the
+     * machine does not move a running session.
+     */
+    id?: string;
     email?: string;
     organization?: string;
     plan?: string;
+    /** The subscription key (D19) – what the limits panel matches figures against. */
+    orgId?: string;
 }
 export interface McpServerStatusInfo {
     name: string;
@@ -197,6 +205,15 @@ export interface AgentRateLimits {
         key: AgentRateLimitWindow['key'];
         resetsAt: string | null;
     } | null;
+    /**
+     * Whose figures these are (#422 §8) – the account the session runs under.
+     * `orgId` is the subscription key (`claude auth status`), `accountUuid` the
+     * signature the CLI itself writes next to a `/usage` reading. Both optional:
+     * a session nobody could identify sends none, and so does every runner from
+     * before #422 – the panel then draws exactly as it did (R12).
+     */
+    accountUuid?: string;
+    orgId?: string;
 }
 /** Everything the dashboard needs to render agent controls, live from the agent. */
 export interface AgentCapabilities {
@@ -727,6 +744,11 @@ export type InterruptOutcome =
 export interface AgentSession {
     /** Ends when the underlying agent process is gone. */
     events: AsyncIterable<AgentEvent>;
+    /**
+     * The account this session's process runs under (#422) – what a refusal or a
+     * successful turn is attributed to (R14). Absent: the machine login.
+     */
+    readonly accountId?: string;
     answerPermission(requestId: string, allow: boolean, note?: string): void;
     /**
      * Answer (or discuss) an open question. Returns false when the ask is no

package/dist/agent-auth.d.ts

@@ -1,7 +1,96 @@
 export declare function agentAuthPath(): string;
+/**
+ * Who a Claude home last said it was – the answer of `claude auth status` in it.
+ *
+ * Kept on disk (#422 R14) so a restarted runner does not forget whose numbers a
+ * usage reading is and whom `auth_status` names as active. Not a verdict on the
+ * login: `auth status` says `loggedIn: true` over a dead credential, which is why
+ * the verdict stays with the credentials file.
+ */
+export interface ClaudeIdentity {
+    email?: string;
+    /** The subscription key (D19, R1): one subscription – one row. */
+    orgId?: string;
+    orgName?: string;
+    /** `subscriptionType` – `max`, `pro`, … */
+    plan?: string;
+    /** When this identity was read, ISO. */
+    at: string;
+}
+/** One saved Claude login of this machine (#422). Files live in its home, not here. */
+export interface ClaudeAccountRecord {
+    id: string;
+    addedAt: string;
+    lastSeenIdentity?: ClaudeIdentity;
+    /**
+     * A session under this account was refused (D2): the row is marked, never
+     * removed. Read against the credentials file – a file written after the mark
+     * (the CLI refreshed, somebody signed in again) outranks it.
+     */
+    loginExpiredAt?: string;
+}
+/**
+ * One saved Codex login of this machine (#422 S4) – the same shape as a Claude
+ * record. `lastSeenIdentity.orgId` carries `tokens.account_id` of its `auth.json`:
+ * the key of a Codex subscription (plan §8), one subscription – one row.
+ */
+export type CodexAccountRecord = ClaudeAccountRecord;
+/** What the runner remembers about the machine row itself – it has no record of its own. */
+export interface ClaudeMachineRecord {
+    lastSeenIdentity?: ClaudeIdentity;
+    /**
+     * A refusal held against the token this runner captured (`claudeOauthToken`)
+     * – set only when the refused session actually ran with that token. It
+     * replaces the old «discard the token after a refusal», which erased the whole
+     * file and with it every saved account (#422 S1 item 3).
+     */
+    loginExpiredAt?: string;
+}
+export interface AgentAuthFile {
+    claudeOauthToken?: string;
+    /**
+     * When `claudeOauthToken` was stored – the token's age, and ONLY that. Every
+     * other write leaves it alone, or saving an account would make a
+     * months-old token look freshly captured.
+     */
+    updatedAt?: string;
+    claudeAccounts?: ClaudeAccountRecord[];
+    /** Absent means the machine login – the pre-#422 file reads exactly as before. */
+    claudeActiveAccount?: string;
+    claudeMachine?: ClaudeMachineRecord;
+    /**
+     * The saved Codex logins of this machine (#422 S4). Their files live in the
+     * runner's CODEX_HOME (`accounts/<id>/auth.json`); WHICH one is active is not
+     * here but in the home itself – the `auth.json` link and its mark – because
+     * that is what the CLI reads.
+     */
+    codexAccounts?: CodexAccountRecord[];
+}
+/** Everything this runner keeps in `agent-auth.json`, read forgivingly. */
+export declare function readAgentAuth(): AgentAuthFile;
+/**
+ * Change some fields of the file and keep every other one.
+ *
+ * Read → change → write, never «write what I know». The two writers this file
+ * had before #422 wrote the WHOLE file (`storeClaudeToken`) or deleted it
+ * (`clearStoredClaudeToken`), and with a list of accounts beside the token either
+ * would have erased every saved login's record on its way past (S1 item 3).
+ *
+ * A file that exists but cannot be parsed is moved aside, not overwritten: it may
+ * be the only record of which home belongs to which account, and «unreadable»
+ * must not quietly become «empty». A file that cannot be READ (EACCES) throws –
+ * writing over something we could not look at is the same mistake.
+ *
+ * Synchronous from read to rename, so two changes inside this process cannot
+ * interleave. Same write-then-rename as the config, 0600.
+ */
+export declare function updateAgentAuth(change: (file: AgentAuthFile) => void): AgentAuthFile;
 /** The token we hold for Claude, or null once it is too old to trust. */
 export declare function storedClaudeToken(): string | null;
+/** When the stored token was captured, in ms – null without one. */
+export declare function storedClaudeTokenAtMs(): number | null;
 export declare function storeClaudeToken(token: string): void;
+/** Drop the stored token – and nothing else: the accounts beside it stay (#422). */
 export declare function clearStoredClaudeToken(): void;
 /**
  * Put a stored token into this process's environment, unless the operator
@@ -15,6 +104,17 @@ export declare function clearStoredClaudeToken(): void;
  * Returns true when it applied one.
  */
 export declare function applyStoredClaudeToken(): boolean;
+/**
+ * Was a session refused with the token this runner captured – after it was
+ * captured? A token stored after the refusal is newer evidence and outranks it.
+ * A token with no readable capture date is judged by the mark alone.
+ */
+export declare function storedClaudeTokenRefused(): boolean;
+/**
+ * The daemon's environment carries exactly the token this runner captured – so
+ * a machine-login session refused now was refused WITH it.
+ */
+export declare function environmentCarriesStoredToken(): boolean;
 /**
  * The OAuth token `claude setup-token` printed, reassembled out of pty output.
  *