@brutalsystems/muster 0.7.14 → 0.7.15

package/dist/identity-copy.js

@@ -1,5 +1,6 @@
 import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import TOML from "@iarna/toml";
 import { identityPath } from "./identity-store.js";
 /**
  * What a copy must contain: enough to start authenticated, onboarded, and
@@ -122,3 +123,62 @@ export async function setWorkspaceTrust(copyPath, cwd) {
     data.projects = projects;
     await writeFile(file, JSON.stringify(data), { mode: 0o600 });
 }
+/**
+ * Set Codex's directory-trust flag for one directory, inside a copy Muster just
+ * created. Codex has its own gate, unrelated to Claude's: without a
+ * `[projects."<dir>"] trust_level = "trusted"` entry in the config.toml it
+ * reads, the TUI stops on "Do you trust the contents of this directory?" before
+ * it ever opens a thread. No thread is opened, so no thread-writer lock is
+ * written, so `resolveCodex` finds nothing and the launch burns its whole
+ * deadline reporting `no descendant runtime identity found`.
+ *
+ * A fresh identity copy has no `projects` table at all, which made EVERY Codex
+ * identity launch fail exactly that way — measured, not inferred: the pane was
+ * captured mid-launch sitting on the prompt while the copy filled with Codex's
+ * own sqlite state and never grew a `thread-writer-locks/` directory.
+ *
+ * `-c projects."<dir>".trust_level="trusted"` does NOT satisfy the gate. It
+ * parses and is accepted, and the prompt still appears: the check reads
+ * persisted config, so the entry has to be in the file.
+ *
+ * The user's real `~/.codex/config.toml` is never touched, for the same reason
+ * `setWorkspaceTrust` leaves the live `~/.claude.json` alone.
+ */
+export async function setCodexWorkspaceTrust(copyPath, cwd) {
+    const file = join(copyPath, "config.toml");
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (e) {
+        // A template that has never been logged into has no config.toml; Codex
+        // runs on defaults. Anything else — EACCES, EISDIR — is a real failure,
+        // and swallowing it would hand the agent a config missing every setting
+        // the template's own login wrote.
+        if (e.code !== "ENOENT")
+            throw e;
+    }
+    let data = {};
+    if (raw !== undefined)
+        try {
+            data = TOML.parse(raw);
+        }
+        catch (e) {
+            // A file that EXISTS and does not parse is not "no file yet". Codex would
+            // refuse it too, so writing over it trades one clear failure for a silent
+            // loss of the template's settings.
+            throw new Error(`${file} exists but is not valid TOML: ${String(e)}`);
+        }
+    const projects = (data.projects ?? {});
+    const existing = (projects[cwd] ?? {});
+    if (existing.trust_level === "trusted")
+        return;
+    projects[cwd] = { ...existing, trust_level: "trusted" };
+    data.projects = projects;
+    // Re-serialised rather than appended, so an entry the template already
+    // carries with a different trust_level is corrected instead of duplicated —
+    // a duplicate table is a TOML error and Codex would refuse the whole file.
+    // Comments and key order in the copy are lost; the copy is per-launch and
+    // machine-read, and the template it came from is untouched.
+    await writeFile(file, TOML.stringify(data), { mode: 0o600 });
+}

package/dist/run.js

@@ -9,7 +9,7 @@ import { enforcementGrade } from "./enforcement.js";
 import { LOCAL } from "./requester.js";
 import { assertEnforcementMeetsMinimum, assertLevelWithinCeiling, assertMayAct, resolveIdentityForRequest, resolveRequesterPolicy, RequesterPolicyRefusal, } from "./requester-policy.js";
 import { IdentityError, readIdentity, } from "./identity-store.js";
-import { copyIdentity, identityEnv, setWorkspaceTrust, } from "./identity-copy.js";
+import { copyIdentity, identityEnv, setCodexWorkspaceTrust, setWorkspaceTrust, } from "./identity-copy.js";
 import { Registry } from "./registry.js";
 import { LaunchLog } from "./log.js";
 import { hosts, selectHost } from "./hosts/index.js";
@@ -314,6 +314,12 @@ export class Muster {
                     // session never registers, and the launch burns its whole deadline.
                     // `assertAllowedWorkspace` already realpaths for containment.
                     await setWorkspaceTrust(copy, await realpath(req.cwd));
+                // Codex gates the same way behind a different file and a different key,
+                // and a fresh copy trusts nothing — so every Codex identity launch sat
+                // on "Do you trust the contents of this directory?" until the deadline.
+                // Resolved for the same reason: Codex keys `projects` by its own cwd.
+                else if (identityMeta.agent === "codex")
+                    await setCodexWorkspaceTrust(copy, await realpath(req.cwd));
                 runtimeEnv = {
                     ...runtimeEnv,
                     ...identityEnv(identityMeta, copy, this.sourceEnv),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "0.7.14",
+  "version": "0.7.15",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {