@bridge4dev/runner 0.66.0 → 0.67.0

package/dist/adapters/codex.d.ts

@@ -1,6 +1,24 @@
 import { type CodexHome } from './codex-home.js';
 import { AppServerClient, type ServerRequest } from './codex-protocol.js';
 import { type AgentAdapter, type AgentQuestion, type AgentSession, type EffortOption, type SessionSpec } from './types.js';
+/** One entry of `/`, as `writableRootsFor` needs it. */
+export interface RootEntry {
+    path: string;
+    /** Where a link leads; null when it leads nowhere. */
+    realPath: string | null;
+    isDirectory: boolean;
+}
+/** Lists `/`; throws when it cannot. Replaced only by tests. */
+export type RootLister = () => RootEntry[];
+/**
+ * The top-level directories a widened sandbox may write to, or null when `/`
+ * could not be read.
+ *
+ * Links are followed to where they lead and counted once (`/bin` → `/usr/bin`
+ * adds nothing `/usr` does not); a directory inside another root is dropped for
+ * the same reason; files (a swap file) and dangling links are skipped.
+ */
+export declare function topLevelWritableRoots(listRoot?: RootLister): string[] | null;
 export interface CodexAdapterDeps {
     /** Injected in tests to drive a scripted app-server. */
     spawnClient?: (options: {
@@ -28,11 +46,15 @@ export interface CodexAdapterDeps {
     repairHome?: () => CodexHome;
     /**
      * How this runner's CODEX_HOME is authenticated (`[codex] auth` in
-     * config.toml). Carried here because every repair has to honour it — a
-     * repair that defaults to `link` would undo an owner's decision to keep the
-     * runner's credential separate.
+     * config.toml) – ONLY when the owner wrote it. Every repair honours it, and a
+     * repair that defaulted to `link` would undo both an owner's decision to keep
+     * the runner's credential separate and a switch to a saved login (#422 S4 item
+     * 2). Production leaves it unset: the daemon records the configured mode once
+     * (`configureCodexAuth`), and the home reads it from there.
      */
     authMode?: 'link' | 'own';
+    /** What `/` holds, for the widened sandbox roots – a test seam (`codex-auto-dev-null`). */
+    listRoot?: RootLister;
     /** #382: how often live helpers are re-checked against Codex – a test seam. */
     subagentReconcileMs?: number;
     /** #382: how long a just-started helper's `idle` is disbelieved – a test seam. */

package/dist/adapters/codex.js

@@ -1,9 +1,12 @@
+import fs from 'node:fs';
+import path from 'node:path';
 import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
 import { evaluateToolUse, maskSecrets, maskString, } from '../policy.js';
 import { memoryDeathSentence, sessionMemoryEnv, sessionMemoryPromptLine } from '../session-cage.js';
 import { RUNNER_VERSION } from '../version.js';
 import { repairCodexAuth } from './codex-home.js';
+import { codexSessionAccount, noteCodexSessionAccount, noteCodexUsage, releaseCodexSessionAccount, } from '../codex-accounts.js';
 import { AppServerClient, asRecord, num, RpcError, RpcTimeoutError, str, } from './codex-protocol.js';
 import { truncate } from './claude.js';
 import { AgentTaskTray } from './agent-tasks.js';
@@ -87,11 +90,79 @@ const MODE_POLICY = {
  *
  * Read on every turn rather than captured at launch, because the setting can be
  * switched while the session runs.
+ *
+ * **Never `/` itself** (gotcha 541, plan `codex-auto-dev-null`). Codex mounts a
+ * writable root without devices, and `/` laid over its own `/dev` left
+ * `/dev/null` visible but unopenable: every `bash -lc` printed «Permission
+ * denied» and `git status` exited 128. The widened roots are the machine's real
+ * top-level directories instead, minus the kernel's own (`/dev`, `/proc`,
+ * `/sys`) – checked on codex-cli 0.154.0 through `command/exec`: `/dev/null`
+ * opens, `git status` passes, a write outside the project is allowed, and, unlike
+ * `/`, a list of directories leaves no empty `.git`/`.codex`/`.agents` behind
+ * (17.09.2026, on throwaway folders – never on this production host's `/`).
  */
-function writableRootsFor(spec) {
+function writableRootsFor(spec, listRoot = listRootEntries) {
     if (spec.trustMode === 'STRICT')
         return [spec.cwd];
-    return spec.gitPolicy?.agentAllowOutsideFolder === true ? ['/'] : [spec.cwd];
+    if (spec.gitPolicy?.agentAllowOutsideFolder !== true)
+        return [spec.cwd];
+    const roots = topLevelWritableRoots(listRoot);
+    if (roots === null || roots.length === 0) {
+        // Unknown means confined (ADR 0007, «polarity»): a step outside asks, as it
+        // did before the permission existed.
+        return [spec.cwd];
+    }
+    return roots;
+}
+/** The kernel's own file systems – never a place a sandbox should bind over. */
+const NEVER_WRITABLE_ROOTS = ['/dev', '/proc', '/sys'];
+function listRootEntries() {
+    // `withFileTypes`, so a top-level entry is judged by what `readdir` already
+    // knows. A `stat` per entry would reach INTO every mount point, and a dead
+    // network mount at the top level would then block the daemon's only thread on
+    // every turn (found by the independent check of S4). Only a symbolic link is
+    // resolved, and those are few (`/bin`, `/lib`, …).
+    return fs.readdirSync('/', { withFileTypes: true }).map((entry) => {
+        const full = path.join('/', entry.name);
+        if (!entry.isSymbolicLink()) {
+            return { path: full, realPath: full, isDirectory: entry.isDirectory() };
+        }
+        try {
+            const realPath = fs.realpathSync(full);
+            return { path: full, realPath, isDirectory: fs.statSync(realPath).isDirectory() };
+        }
+        catch {
+            return { path: full, realPath: null, isDirectory: false };
+        }
+    });
+}
+/**
+ * The top-level directories a widened sandbox may write to, or null when `/`
+ * could not be read.
+ *
+ * Links are followed to where they lead and counted once (`/bin` → `/usr/bin`
+ * adds nothing `/usr` does not); a directory inside another root is dropped for
+ * the same reason; files (a swap file) and dangling links are skipped.
+ */
+export function topLevelWritableRoots(listRoot = listRootEntries) {
+    let entries;
+    try {
+        entries = listRoot();
+    }
+    catch (error) {
+        log.warn('codex: could not read the top-level folders – the sandbox stays on the project folder', {
+            error: String(error).slice(0, 200),
+        });
+        return null;
+    }
+    const kernel = (dir) => NEVER_WRITABLE_ROOTS.some((root) => dir === root || dir.startsWith(`${root}/`));
+    const unique = [
+        ...new Set(entries
+            .filter((entry) => entry.isDirectory && entry.realPath !== null)
+            .map((entry) => path.resolve(entry.realPath))
+            .filter((dir) => dir !== '/' && !kernel(dir))),
+    ].sort();
+    return unique.filter((dir) => !unique.some((other) => other !== dir && dir.startsWith(`${other}/`)));
 }
 /**
  * DevBridge's own rules — composed per session since session 18, and kept
@@ -214,6 +285,15 @@ class CodexSession {
     queuedInput = [];
     /** Null when the home was injected — an injected home is the whole truth. */
     repairHome;
+    /**
+     * The login this process started under (#422 S4), kept to its end: the machine
+     * may be switched while it runs, and its limits, its card and a refusal it meets
+     * all belong to THIS account (R14). Codex itself keeps a running session on the
+     * account it started with – it will not refresh into another account's file.
+     */
+    account;
+    accountId;
+    listRoot;
     /** Open elicitations, oldest first — Codex may have several in flight. */
     questions = new Map();
     threadId = null;
@@ -279,6 +359,12 @@ class CodexSession {
         this.model = spec.model;
         this.effort = spec.effort;
         this.repairHome = deps.repairHome ?? (deps.codexHome ? null : repairCodexAuth);
+        this.listRoot = deps.listRoot;
+        this.account = codexSessionAccount(home);
+        this.accountId = this.account.id;
+        // Released in `finish`, and only by THIS session: «forget» refuses a login a
+        // live process refreshes into.
+        noteCodexSessionAccount(spec.sessionId, this.accountId, this);
         const wiring = {
             // The cage's two numbers ride along (#398 S5). Built here rather than
             // inside `scrubbedEnv`, which has no access to the session — and merged
@@ -346,6 +432,13 @@ class CodexSession {
                 throw new Error(`codex is using an unexpected CODEX_HOME (${reportedHome ?? 'not reported'}) — refusing to start the session`);
             }
             this.client.notify('initialized', {});
+            // The app-server reads `auth.json` while it starts, so the login it ended
+            // up with is the one the link points at NOW, not the one this object read
+            // before the process existed. A switch in that window is rare and would
+            // otherwise put the previous account's name on this session's card and its
+            // limits (found by the independent check of S4). The row it is noted under
+            // moves with it, so «forget» refuses the right one.
+            this.rereadAccount();
             // The helper set is per PROCESS (#113, #382): a session relaunched after a
             // runner restart must not go on showing the helpers of its previous life,
             // and nothing else would say so until the next one starts or ends.
@@ -675,7 +768,7 @@ class CodexSession {
             input: [{ type: 'text', text, text_elements: [] }],
             approvalPolicy: policy.approvalPolicy,
             // #418: the roots live here and only here — see `writableRootsFor`.
-            sandboxPolicy: sandboxPolicyFor(policy.sandbox, this.spec),
+            sandboxPolicy: sandboxPolicyFor(policy.sandbox, this.spec, this.listRoot),
             ...(this.model ? { model: this.model } : {}),
             // "Override the reasoning effort for this turn and subsequent turns" —
             // the same sticky-override channel the model uses (there is still no
@@ -1835,6 +1928,13 @@ class CodexSession {
         this.emitRateLimits();
     }
     emitRateLimits(blocked = null) {
+        // Whose figures these are (#422 §8): the subscription this session started
+        // under. Codex reports the windows of the account its process is signed in
+        // with, and that is the account captured at the start – so the signature is
+        // true for the whole life of the session. No key (an API-key login) – no
+        // signature, and the panel draws as before #422 (R12).
+        const orgId = this.account.orgId;
+        noteCodexUsage(orgId, this.rateLimitWindows);
         // An empty snapshot is «no plan», not «nothing happened»: Codex sends this
         // for API-key accounts too, and the popup has to be able to say so.
         this.emit({
@@ -1845,6 +1945,7 @@ class CodexSession {
                 planType: this.ratePlanType,
                 measuredAt: new Date().toISOString(),
                 windows: this.rateLimitWindows,
+                ...(orgId ? { orgId } : {}),
             },
         });
     }
@@ -2194,6 +2295,27 @@ class CodexSession {
             this.capabilitiesInFlight = false;
         });
     }
+    /** Who the home belongs to now – after the app-server has read its credential. */
+    rereadAccount() {
+        if (!this.repairHome)
+            return;
+        try {
+            const now = codexSessionAccount(this.repairHome());
+            if (now.id === this.account.id)
+                return;
+            log.info('codex: the machine changed its Codex login while this session was starting', {
+                sessionId: this.spec.sessionId,
+                from: this.account.id,
+                to: now.id,
+            });
+            this.account = now;
+            this.accountId = now.id;
+            noteCodexSessionAccount(this.spec.sessionId, now.id, this);
+        }
+        catch (error) {
+            log.warn('codex: could not re-read the account after start', { error: describe(error) });
+        }
+    }
     async publishCapabilities() {
         // Every probe carries its own catch: an unknown method on a newer or older
         // codex must degrade a picker, not kill the session.
@@ -2218,7 +2340,7 @@ class CodexSession {
             currentMode: this.mode,
             ...(currentModel ? { currentModel } : {}),
             ...(currentEffort ? { currentEffort } : {}),
-            ...(account ? { account } : {}),
+            account: this.sessionAccountCard(account),
             mcpServers,
             interrupt: true,
         };
@@ -2358,6 +2480,21 @@ class CodexSession {
         }
         return options;
     }
+    /**
+     * The card's account: what the live process says about itself (`account/read`),
+     * under the row and the subscription the session started with (#422 §8) – the
+     * `id` a «forget» is refused for, the `orgId` the limits panel matches against.
+     */
+    sessionAccountCard(live) {
+        const plan = live?.plan ?? (this.account.plan ? `ChatGPT ${this.account.plan}` : undefined);
+        const email = live?.email ?? this.account.email;
+        return {
+            id: this.account.id,
+            ...(email ? { email } : {}),
+            ...(plan ? { plan } : {}),
+            ...(this.account.orgId ? { orgId: this.account.orgId } : {}),
+        };
+    }
     async readAccount() {
         const result = asRecord(await this.client.request('account/read', {}, 15_000));
         const account = asRecord(result['account']);
@@ -2505,6 +2642,7 @@ class CodexSession {
         return home.auth === 'missing' ? 'missing' : 'expired';
     }
     finish() {
+        releaseCodexSessionAccount(this.spec.sessionId, this);
         this.stopped = true;
         this.clearLimitSettle();
         this.subagents.close();
@@ -2514,7 +2652,7 @@ class CodexSession {
 }
 class ResumeFailed extends Error {
 }
-function sandboxPolicyFor(mode, spec) {
+function sandboxPolicyFor(mode, spec, listRoot) {
     // turn/start takes the structured SandboxPolicy, while thread/start takes the
     // CLI-style SandboxMode string. Same intent, two shapes — and only this one
     // can name the writable roots, which is why #418 lives here.
@@ -2526,7 +2664,7 @@ function sandboxPolicyFor(mode, spec) {
         default:
             return {
                 type: 'workspaceWrite',
-                writableRoots: writableRootsFor(spec),
+                writableRoots: writableRootsFor(spec, listRoot),
                 // Unchanged by #418, on purpose: the permission is about the file
                 // system, and letting the network out with it would be a second
                 // boundary nobody asked to move. A network command still fails in the
@@ -2796,11 +2934,11 @@ export class CodexAdapter {
         // Re-assert rather than reuse: `repairCodexAuth` is a couple of lstat calls
         // and it puts a credential link back if something removed it since boot.
         //
-        // The configured mode has to travel with it. Repairing with the default
-        // would silently re-link the host user's credential into a home the owner
-        // explicitly asked to keep isolated — turning off a security control by
-        // accident.
-        const repair = () => repairCodexAuth({ auth: this.deps.authMode ?? 'link' });
+        // The configured mode has to travel with it – and only a configured one.
+        // Repairing with a default would silently re-link the host user's credential
+        // into a home the owner explicitly asked to keep isolated, and undo a switch
+        // to a saved login at every session start (#422 S4 item 2).
+        const repair = () => repairCodexAuth(this.deps.authMode ? { auth: this.deps.authMode } : {});
         const home = this.deps.codexHome ?? repair();
         return new CodexSession(spec, home, {
             ...this.deps,

package/dist/agent-auth.d.ts

@@ -29,6 +29,12 @@ export interface ClaudeAccountRecord {
      */
     loginExpiredAt?: string;
 }
+/**
+ * One saved Codex login of this machine (#422 S4) – the same shape as a Claude
+ * record. `lastSeenIdentity.orgId` carries `tokens.account_id` of its `auth.json`:
+ * the key of a Codex subscription (plan §8), one subscription – one row.
+ */
+export type CodexAccountRecord = ClaudeAccountRecord;
 /** What the runner remembers about the machine row itself – it has no record of its own. */
 export interface ClaudeMachineRecord {
     lastSeenIdentity?: ClaudeIdentity;
@@ -52,6 +58,13 @@ export interface AgentAuthFile {
     /** Absent means the machine login – the pre-#422 file reads exactly as before. */
     claudeActiveAccount?: string;
     claudeMachine?: ClaudeMachineRecord;
+    /**
+     * The saved Codex logins of this machine (#422 S4). Their files live in the
+     * runner's CODEX_HOME (`accounts/<id>/auth.json`); WHICH one is active is not
+     * here but in the home itself – the `auth.json` link and its mark – because
+     * that is what the CLI reads.
+     */
+    codexAccounts?: CodexAccountRecord[];
 }
 /** Everything this runner keeps in `agent-auth.json`, read forgivingly. */
 export declare function readAgentAuth(): AgentAuthFile;

package/dist/agent-auth.js

@@ -65,6 +65,29 @@ function readIdentity(value) {
         at,
     };
 }
+/** A list of account records, each read on its own: one unreadable entry drops only itself. */
+function parseRecords(entries) {
+    const seen = new Set();
+    return entries.flatMap((entry) => {
+        if (!isObject(entry))
+            return [];
+        const id = shortString(entry['id'], 64);
+        const addedAt = isoString(entry['addedAt']);
+        if (!id || !addedAt || seen.has(id))
+            return [];
+        seen.add(id);
+        const identity = readIdentity(entry['lastSeenIdentity']);
+        const expiredAt = isoString(entry['loginExpiredAt']);
+        return [
+            {
+                id,
+                addedAt,
+                ...(identity ? { lastSeenIdentity: identity } : {}),
+                ...(expiredAt ? { loginExpiredAt: expiredAt } : {}),
+            },
+        ];
+    });
+}
 /**
  * The file as it was written, field by field.
  *
@@ -81,28 +104,10 @@ function parse(raw) {
         file.claudeOauthToken = raw['claudeOauthToken'];
     if (typeof raw['updatedAt'] === 'string')
         file.updatedAt = raw['updatedAt'];
-    if (Array.isArray(raw['claudeAccounts'])) {
-        const seen = new Set();
-        file.claudeAccounts = raw['claudeAccounts'].flatMap((entry) => {
-            if (!isObject(entry))
-                return [];
-            const id = shortString(entry['id'], 64);
-            const addedAt = isoString(entry['addedAt']);
-            if (!id || !addedAt || seen.has(id))
-                return [];
-            seen.add(id);
-            const identity = readIdentity(entry['lastSeenIdentity']);
-            const expiredAt = isoString(entry['loginExpiredAt']);
-            return [
-                {
-                    id,
-                    addedAt,
-                    ...(identity ? { lastSeenIdentity: identity } : {}),
-                    ...(expiredAt ? { loginExpiredAt: expiredAt } : {}),
-                },
-            ];
-        });
-    }
+    if (Array.isArray(raw['claudeAccounts']))
+        file.claudeAccounts = parseRecords(raw['claudeAccounts']);
+    if (Array.isArray(raw['codexAccounts']))
+        file.codexAccounts = parseRecords(raw['codexAccounts']);
     const active = shortString(raw['claudeActiveAccount'], 64);
     if (active)
         file.claudeActiveAccount = active;
@@ -122,6 +127,7 @@ const KNOWN_KEYS = new Set([
     'claudeAccounts',
     'claudeActiveAccount',
     'claudeMachine',
+    'codexAccounts',
 ]);
 const RECORD_KEYS = new Set(['id', 'addedAt', 'lastSeenIdentity', 'loginExpiredAt']);
 const MACHINE_KEYS = new Set(['lastSeenIdentity', 'loginExpiredAt']);
@@ -142,6 +148,28 @@ function mergeObject(raw, known, keys, identityRaw) {
         merged['lastSeenIdentity'] = { ...unknownFields(identityRaw, IDENTITY_KEYS), ...identity };
     return merged;
 }
+/** The lists of account records – both agents keep theirs in the same shape (#422 S4). */
+const RECORD_LISTS = new Set(['claudeAccounts', 'codexAccounts']);
+/**
+ * One list of records as it is to be written: every record this runner knows,
+ * over the unknown fields the same record had on disk, followed by the records it
+ * could not read at all. `undefined` – the list is not written.
+ */
+function mergeRecordList(original, list, known) {
+    const rawAccounts = Array.isArray(original[list]) ? original[list] : [];
+    const rawById = new Map(rawAccounts.filter(isObject).map((entry) => [String(entry['id']), entry]));
+    const readable = new Set((parse(original)[list] ?? []).map((record) => record.id));
+    const accounts = (known ?? []).map((record) => {
+        const rawEntry = rawById.get(record.id);
+        return mergeObject(rawEntry, record, RECORD_KEYS, isObject(rawEntry) ? rawEntry['lastSeenIdentity'] : undefined);
+    });
+    const unreadable = rawAccounts.filter((entry) => !isObject(entry) || !readable.has(String(entry['id'])));
+    if (accounts.length + unreadable.length === 0)
+        return undefined;
+    if (!known && unreadable.length === 0)
+        return undefined;
+    return [...accounts, ...unreadable];
+}
 /**
  * The file to write: what this runner knows, over everything a newer runner put
  * there – at the top level, inside each account record and its identity, and
@@ -151,20 +179,16 @@ function mergeObject(raw, known, keys, identityRaw) {
 function withForeignFields(original, known) {
     const body = unknownFields(original, KNOWN_KEYS);
     for (const [key, value] of Object.entries(known)) {
-        if (value === undefined || key === 'claudeAccounts' || key === 'claudeMachine')
+        if (value === undefined || RECORD_LISTS.has(key))
+            continue;
+        if (key === 'claudeMachine')
             continue;
         body[key] = value;
     }
-    const rawAccounts = Array.isArray(original['claudeAccounts']) ? original['claudeAccounts'] : [];
-    const rawById = new Map(rawAccounts.filter(isObject).map((entry) => [String(entry['id']), entry]));
-    const readable = new Set((parse(original).claudeAccounts ?? []).map((record) => record.id));
-    const accounts = (known.claudeAccounts ?? []).map((record) => {
-        const rawEntry = rawById.get(record.id);
-        return mergeObject(rawEntry, record, RECORD_KEYS, isObject(rawEntry) ? rawEntry['lastSeenIdentity'] : undefined);
-    });
-    const unreadable = rawAccounts.filter((entry) => !isObject(entry) || !readable.has(String(entry['id'])));
-    if (accounts.length + unreadable.length > 0 && (known.claudeAccounts || unreadable.length > 0)) {
-        body['claudeAccounts'] = [...accounts, ...unreadable];
+    for (const list of RECORD_LISTS) {
+        const records = mergeRecordList(original, list, known[list]);
+        if (records)
+            body[list] = records;
     }
     if (known.claudeMachine) {
         const rawMachine = original['claudeMachine'];

package/dist/auth-relay.d.ts

@@ -105,7 +105,7 @@ export declare class AuthRelay {
      * (it prints an inference-only token, D1), so a «saved account» made from it
      * would be a row with no login. `machine` keeps the fallback it always had.
      */
-    startAccountLogin(target: AccountLoginTarget): Promise<LoginStartResult>;
+    startAccountLogin(target: AccountLoginTarget, agent?: RelayAgent): Promise<LoginStartResult>;
     /** The CLI and the pty helper are both there – or a sentence saying which is not. */
     private assertCanRun;
     private startWith;
@@ -198,6 +198,10 @@ export declare function agentAuthFailureActive(agent: RelayAgent, accountId?: st
  * Codex reports its own login state via an exit code (0 signed in / 1 not).
  * Probed against the RUNNER's home: the host user can be signed in while our
  * isolated home is not, and it is ours that sessions use.
+ *
+ * About the login new sessions start under (#422 S4): the machine login through
+ * the link, or the saved login the link points at – named in `activeAccount`,
+ * read locally from the file, no CLI for it (R14).
  */
 export declare function codexAuthStatus(): Promise<AgentAuthStatus>;
 export declare function agentAuthStatuses(): Promise<{