@cabane/companion 0.6.30 → 0.6.32

package/dist/cli.js

@@ -5514,9 +5514,13 @@ function sealHeld2(held, terminal) {
 import { z as z11 } from "zod";
 function codexToolPolicy(policy) {
   return policy.hostFs ? {
-    permissionProfile: "cabane-coding",
+    sandboxMode: "danger-full-access",
+    // Headless: nothing to approve, because nothing is denied.
     approvalPolicy: "never",
-    networkAccessEnabled: policy.web
+    // Full access means the command network is open regardless of the grant —
+    // recorded as `true` so the value never claims a restriction that isn't
+    // enforced.
+    networkAccessEnabled: true
   } : {
     sandboxMode: "read-only",
     // Headless: the sandbox is the boundary; never pause for a human.
@@ -5636,7 +5640,6 @@ function buildConfig(req, baseInstructionsFile) {
       default_tools_approval_mode: "approve"
     };
   }
-  const policy = codexToolPolicy(req.policy);
   const tmpDir = req.local.env?.TMPDIR;
   const shellEnv = {};
   if (tmpDir) shellEnv.TMPDIR = tmpDir;
@@ -5644,7 +5647,6 @@ function buildConfig(req, baseInstructionsFile) {
     const value = req.local.env?.[key];
     if (value !== void 0) shellEnv[key] = value;
   }
-  const gateLockDir = req.local.env?.CABANE_GATE_LOCK_DIR;
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
@@ -5652,28 +5654,7 @@ function buildConfig(req, baseInstructionsFile) {
     // becomes Codex's base instructions, and Codex's own environment preamble goes
     // with the harness prompt it belonged to.
     ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
-    ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {},
-    ...policy.permissionProfile ? {
-      // CT733: named permission profiles are Codex's split-filesystem path.
-      // `:root = read` preserves coding-mode host reads; the one explicit
-      // workspace-root write grants the checkout, and the more-specific
-      // `.git` write reopens the metadata Codex protects by default. Neither
-      // rule grants an adjacent directory. Do not combine this with legacy `sandbox_mode` /
-      // `sandbox_workspace_write`, which would restore the `.git` carve-out.
-      approval_policy: policy.approvalPolicy,
-      default_permissions: policy.permissionProfile,
-      permissions: {
-        [policy.permissionProfile]: {
-          filesystem: {
-            ":root": "read",
-            ":workspace_roots": { ".": "write", ".git": "write" },
-            // The one absolute-path grant — see the CT612-fallout note above.
-            ...gateLockDir ? { [gateLockDir]: "write" } : {}
-          },
-          network: { enabled: policy.networkAccessEnabled, mode: "full" }
-        }
-      }
-    } : {}
+    ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {}
   };
 }
 function isStringRecord2(v) {
@@ -5687,11 +5668,10 @@ import {
 function buildSdkThreadOptions(spec) {
   return {
     ...spec.model ? { model: spec.model } : {},
-    ...spec.policy.sandboxMode ? { sandboxMode: spec.policy.sandboxMode } : {},
+    sandboxMode: spec.policy.sandboxMode,
     workingDirectory: spec.directory,
     skipGitRepoCheck: spec.skipGitRepoCheck,
-    ...spec.policy.sandboxMode ? { approvalPolicy: spec.policy.approvalPolicy } : {},
-    ...spec.policy.sandboxMode === "workspace-write" ? { networkAccessEnabled: spec.policy.networkAccessEnabled } : {},
+    approvalPolicy: spec.policy.approvalPolicy,
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
@@ -6475,7 +6455,7 @@ var ConnectorHealthStore = class {
 
 // src/dispatcher.ts
 import { randomUUID } from "crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync11, statSync } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync11, readdirSync as readdirSync2, statSync } from "fs";
 import { join as join15 } from "path";
 
 // src/summon.ts
@@ -7371,10 +7351,19 @@ var DEFAULT_PREPARING_ROW_DELAY_MS = 1500;
 var DEFAULT_AGENT_IDLE_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_AGENT_TOTAL_TIMEOUT_MS = 6 * 60 * 6e4;
 function checkoutState(cwd) {
-  if (!cwd) return { ok: false, reason: "no checkout was resolved for this turn" };
-  if (!existsSync11(cwd)) return { ok: false, reason: `the checkout directory is gone (${cwd})` };
+  if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
+  if (!existsSync11(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
+  let entries;
+  try {
+    entries = readdirSync2(cwd);
+  } catch (error) {
+    return { ok: false, reason: `${cwd} is unreadable (${error.message})` };
+  }
+  if (entries.length === 0) {
+    return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
+  }
   const gitPath = join15(cwd, ".git");
-  if (!existsSync11(gitPath)) return { ok: false, reason: `${cwd} holds no git metadata` };
+  if (!existsSync11(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
     stat = statSync(gitPath);
@@ -7708,22 +7697,7 @@ ${reason}`,
         }
       }
     }
-    let turnEnv = hookEnv;
-    if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join15(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
-      try {
-        mkdirSync11(tmpDir, { recursive: true });
-        turnEnv = { ...hookEnv, TMPDIR: tmpDir };
-      } catch (err) {
-        turnLog.warn(
-          { err: err instanceof Error ? err.message : String(err), tmpDir },
-          "dispatcher: failed to create per-turn TMPDIR \u2014 proceeding with the inherited temp dir"
-        );
-      }
-    }
-    if (turnContext.runtime === "codex" && process.env.CABANE_GATE_LOCK_DIR) {
-      turnEnv = { ...turnEnv, CABANE_GATE_LOCK_DIR: process.env.CABANE_GATE_LOCK_DIR };
-    }
+    const turnEnv = hookEnv;
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
     this.aborts.set(key, abortController);
@@ -8588,7 +8562,7 @@ async function enumerateOpencodeModels(serverUrl, fetchImpl = fetch) {
 import {
   existsSync as existsSync12,
   mkdirSync as mkdirSync12,
-  readdirSync as readdirSync2,
+  readdirSync as readdirSync3,
   readFileSync as readFileSync9,
   renameSync as renameSync3,
   rmSync as rmSync7,
@@ -8645,7 +8619,7 @@ var Outbox = class {
     if (!existsSync12(dir2)) return [];
     let names;
     try {
-      names = readdirSync2(dir2);
+      names = readdirSync3(dir2);
     } catch {
       return [];
     }
@@ -8680,7 +8654,7 @@ var Outbox = class {
     const dir2 = this.dir();
     if (!existsSync12(dir2)) return 0;
     try {
-      return readdirSync2(dir2).filter((n) => n.endsWith(".json")).length;
+      return readdirSync3(dir2).filter((n) => n.endsWith(".json")).length;
     } catch {
       return 0;
     }
@@ -10058,7 +10032,7 @@ companion: deploy drain requested (${graceMs}ms grace)\u2026
 }
 
 // src/commands/status.ts
-import { readdirSync as readdirSync3 } from "fs";
+import { readdirSync as readdirSync4 } from "fs";
 async function status(deps = {}) {
   const readService = deps.service ?? serviceStatus;
   const cfg = loadConfig();
@@ -10129,7 +10103,7 @@ function transcriptsLine() {
   let count = 0;
   let newest;
   try {
-    const files = readdirSync3(dir2).filter((f) => f.endsWith(".jsonl")).sort();
+    const files = readdirSync4(dir2).filter((f) => f.endsWith(".jsonl")).sort();
     count = files.length;
     newest = files[files.length - 1];
   } catch {
@@ -10229,7 +10203,7 @@ function isAlive(kill, pid) {
 }
 
 // src/commands/transcript.ts
-import { existsSync as existsSync14, readFileSync as readFileSync11, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync11, readdirSync as readdirSync5 } from "fs";
 import { isAbsolute, join as join18 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
@@ -10355,7 +10329,7 @@ async function followTranscripts(dir2) {
 }
 function listFiles(dir2) {
   try {
-    return readdirSync4(dir2).filter((f) => f.endsWith(".jsonl")).sort().reverse();
+    return readdirSync5(dir2).filter((f) => f.endsWith(".jsonl")).sort().reverse();
   } catch {
     return [];
   }

package/dist/runtime.js

@@ -4626,9 +4626,13 @@ function sealHeld2(held, terminal) {
 import { z as z11 } from "zod";
 function codexToolPolicy(policy) {
   return policy.hostFs ? {
-    permissionProfile: "cabane-coding",
+    sandboxMode: "danger-full-access",
+    // Headless: nothing to approve, because nothing is denied.
     approvalPolicy: "never",
-    networkAccessEnabled: policy.web
+    // Full access means the command network is open regardless of the grant —
+    // recorded as `true` so the value never claims a restriction that isn't
+    // enforced.
+    networkAccessEnabled: true
   } : {
     sandboxMode: "read-only",
     // Headless: the sandbox is the boundary; never pause for a human.
@@ -4748,7 +4752,6 @@ function buildConfig(req, baseInstructionsFile) {
       default_tools_approval_mode: "approve"
     };
   }
-  const policy = codexToolPolicy(req.policy);
   const tmpDir = req.local.env?.TMPDIR;
   const shellEnv = {};
   if (tmpDir) shellEnv.TMPDIR = tmpDir;
@@ -4756,7 +4759,6 @@ function buildConfig(req, baseInstructionsFile) {
     const value = req.local.env?.[key];
     if (value !== void 0) shellEnv[key] = value;
   }
-  const gateLockDir = req.local.env?.CABANE_GATE_LOCK_DIR;
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
@@ -4764,28 +4766,7 @@ function buildConfig(req, baseInstructionsFile) {
     // becomes Codex's base instructions, and Codex's own environment preamble goes
     // with the harness prompt it belonged to.
     ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
-    ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {},
-    ...policy.permissionProfile ? {
-      // CT733: named permission profiles are Codex's split-filesystem path.
-      // `:root = read` preserves coding-mode host reads; the one explicit
-      // workspace-root write grants the checkout, and the more-specific
-      // `.git` write reopens the metadata Codex protects by default. Neither
-      // rule grants an adjacent directory. Do not combine this with legacy `sandbox_mode` /
-      // `sandbox_workspace_write`, which would restore the `.git` carve-out.
-      approval_policy: policy.approvalPolicy,
-      default_permissions: policy.permissionProfile,
-      permissions: {
-        [policy.permissionProfile]: {
-          filesystem: {
-            ":root": "read",
-            ":workspace_roots": { ".": "write", ".git": "write" },
-            // The one absolute-path grant — see the CT612-fallout note above.
-            ...gateLockDir ? { [gateLockDir]: "write" } : {}
-          },
-          network: { enabled: policy.networkAccessEnabled, mode: "full" }
-        }
-      }
-    } : {}
+    ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {}
   };
 }
 function isStringRecord2(v) {
@@ -4799,11 +4780,10 @@ import {
 function buildSdkThreadOptions(spec) {
   return {
     ...spec.model ? { model: spec.model } : {},
-    ...spec.policy.sandboxMode ? { sandboxMode: spec.policy.sandboxMode } : {},
+    sandboxMode: spec.policy.sandboxMode,
     workingDirectory: spec.directory,
     skipGitRepoCheck: spec.skipGitRepoCheck,
-    ...spec.policy.sandboxMode ? { approvalPolicy: spec.policy.approvalPolicy } : {},
-    ...spec.policy.sandboxMode === "workspace-write" ? { networkAccessEnabled: spec.policy.networkAccessEnabled } : {},
+    approvalPolicy: spec.policy.approvalPolicy,
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
@@ -5587,7 +5567,7 @@ var ConnectorHealthStore = class {
 
 // src/dispatcher.ts
 import { randomUUID } from "crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync9, statSync } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync9, readdirSync as readdirSync2, statSync } from "fs";
 import { join as join13 } from "path";
 
 // src/summon.ts
@@ -6483,10 +6463,19 @@ var DEFAULT_PREPARING_ROW_DELAY_MS = 1500;
 var DEFAULT_AGENT_IDLE_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_AGENT_TOTAL_TIMEOUT_MS = 6 * 60 * 6e4;
 function checkoutState(cwd) {
-  if (!cwd) return { ok: false, reason: "no checkout was resolved for this turn" };
-  if (!existsSync9(cwd)) return { ok: false, reason: `the checkout directory is gone (${cwd})` };
+  if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
+  if (!existsSync9(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
+  let entries;
+  try {
+    entries = readdirSync2(cwd);
+  } catch (error) {
+    return { ok: false, reason: `${cwd} is unreadable (${error.message})` };
+  }
+  if (entries.length === 0) {
+    return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
+  }
   const gitPath = join13(cwd, ".git");
-  if (!existsSync9(gitPath)) return { ok: false, reason: `${cwd} holds no git metadata` };
+  if (!existsSync9(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
     stat = statSync(gitPath);
@@ -6820,22 +6809,7 @@ ${reason}`,
         }
       }
     }
-    let turnEnv = hookEnv;
-    if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join13(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
-      try {
-        mkdirSync9(tmpDir, { recursive: true });
-        turnEnv = { ...hookEnv, TMPDIR: tmpDir };
-      } catch (err) {
-        turnLog.warn(
-          { err: err instanceof Error ? err.message : String(err), tmpDir },
-          "dispatcher: failed to create per-turn TMPDIR \u2014 proceeding with the inherited temp dir"
-        );
-      }
-    }
-    if (turnContext.runtime === "codex" && process.env.CABANE_GATE_LOCK_DIR) {
-      turnEnv = { ...turnEnv, CABANE_GATE_LOCK_DIR: process.env.CABANE_GATE_LOCK_DIR };
-    }
+    const turnEnv = hookEnv;
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
     this.aborts.set(key, abortController);
@@ -7700,7 +7674,7 @@ async function enumerateOpencodeModels(serverUrl, fetchImpl = fetch) {
 import {
   existsSync as existsSync10,
   mkdirSync as mkdirSync10,
-  readdirSync as readdirSync2,
+  readdirSync as readdirSync3,
   readFileSync as readFileSync8,
   renameSync as renameSync3,
   rmSync as rmSync6,
@@ -7757,7 +7731,7 @@ var Outbox = class {
     if (!existsSync10(dir2)) return [];
     let names;
     try {
-      names = readdirSync2(dir2);
+      names = readdirSync3(dir2);
     } catch {
       return [];
     }
@@ -7792,7 +7766,7 @@ var Outbox = class {
     const dir2 = this.dir();
     if (!existsSync10(dir2)) return 0;
     try {
-      return readdirSync2(dir2).filter((n) => n.endsWith(".json")).length;
+      return readdirSync3(dir2).filter((n) => n.endsWith(".json")).length;
     } catch {
       return 0;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.30",
+  "version": "0.6.32",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",