@cabane/companion 0.6.31 → 0.6.32

package/dist/cli.js

@@ -5514,9 +5514,13 @@ function sealHeld2(held, terminal) {
 import { z as z11 } from "zod";
 function codexToolPolicy(policy) {
   return policy.hostFs ? {
-    permissionProfile: "cabane-coding",
+    sandboxMode: "danger-full-access",
+    // Headless: nothing to approve, because nothing is denied.
     approvalPolicy: "never",
-    networkAccessEnabled: policy.web
+    // Full access means the command network is open regardless of the grant —
+    // recorded as `true` so the value never claims a restriction that isn't
+    // enforced.
+    networkAccessEnabled: true
   } : {
     sandboxMode: "read-only",
     // Headless: the sandbox is the boundary; never pause for a human.
@@ -5636,7 +5640,6 @@ function buildConfig(req, baseInstructionsFile) {
       default_tools_approval_mode: "approve"
     };
   }
-  const policy = codexToolPolicy(req.policy);
   const tmpDir = req.local.env?.TMPDIR;
   const shellEnv = {};
   if (tmpDir) shellEnv.TMPDIR = tmpDir;
@@ -5644,7 +5647,6 @@ function buildConfig(req, baseInstructionsFile) {
     const value = req.local.env?.[key];
     if (value !== void 0) shellEnv[key] = value;
   }
-  const gateLockDir = req.local.env?.CABANE_GATE_LOCK_DIR;
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
@@ -5652,28 +5654,7 @@ function buildConfig(req, baseInstructionsFile) {
     // becomes Codex's base instructions, and Codex's own environment preamble goes
     // with the harness prompt it belonged to.
     ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
-    ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {},
-    ...policy.permissionProfile ? {
-      // CT733: named permission profiles are Codex's split-filesystem path.
-      // `:root = read` preserves coding-mode host reads; the one explicit
-      // workspace-root write grants the checkout, and the more-specific
-      // `.git` write reopens the metadata Codex protects by default. Neither
-      // rule grants an adjacent directory. Do not combine this with legacy `sandbox_mode` /
-      // `sandbox_workspace_write`, which would restore the `.git` carve-out.
-      approval_policy: policy.approvalPolicy,
-      default_permissions: policy.permissionProfile,
-      permissions: {
-        [policy.permissionProfile]: {
-          filesystem: {
-            ":root": "read",
-            ":workspace_roots": { ".": "write", ".git": "write" },
-            // The one absolute-path grant — see the CT612-fallout note above.
-            ...gateLockDir ? { [gateLockDir]: "write" } : {}
-          },
-          network: { enabled: policy.networkAccessEnabled, mode: "full" }
-        }
-      }
-    } : {}
+    ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {}
   };
 }
 function isStringRecord2(v) {
@@ -5687,11 +5668,10 @@ import {
 function buildSdkThreadOptions(spec) {
   return {
     ...spec.model ? { model: spec.model } : {},
-    ...spec.policy.sandboxMode ? { sandboxMode: spec.policy.sandboxMode } : {},
+    sandboxMode: spec.policy.sandboxMode,
     workingDirectory: spec.directory,
     skipGitRepoCheck: spec.skipGitRepoCheck,
-    ...spec.policy.sandboxMode ? { approvalPolicy: spec.policy.approvalPolicy } : {},
-    ...spec.policy.sandboxMode === "workspace-write" ? { networkAccessEnabled: spec.policy.networkAccessEnabled } : {},
+    approvalPolicy: spec.policy.approvalPolicy,
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
@@ -7717,22 +7697,7 @@ ${reason}`,
         }
       }
     }
-    let turnEnv = hookEnv;
-    if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join15(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
-      try {
-        mkdirSync11(tmpDir, { recursive: true });
-        turnEnv = { ...hookEnv, TMPDIR: tmpDir };
-      } catch (err) {
-        turnLog.warn(
-          { err: err instanceof Error ? err.message : String(err), tmpDir },
-          "dispatcher: failed to create per-turn TMPDIR \u2014 proceeding with the inherited temp dir"
-        );
-      }
-    }
-    if (turnContext.runtime === "codex" && process.env.CABANE_GATE_LOCK_DIR) {
-      turnEnv = { ...turnEnv, CABANE_GATE_LOCK_DIR: process.env.CABANE_GATE_LOCK_DIR };
-    }
+    const turnEnv = hookEnv;
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
     this.aborts.set(key, abortController);

package/dist/runtime.js

@@ -4626,9 +4626,13 @@ function sealHeld2(held, terminal) {
 import { z as z11 } from "zod";
 function codexToolPolicy(policy) {
   return policy.hostFs ? {
-    permissionProfile: "cabane-coding",
+    sandboxMode: "danger-full-access",
+    // Headless: nothing to approve, because nothing is denied.
     approvalPolicy: "never",
-    networkAccessEnabled: policy.web
+    // Full access means the command network is open regardless of the grant —
+    // recorded as `true` so the value never claims a restriction that isn't
+    // enforced.
+    networkAccessEnabled: true
   } : {
     sandboxMode: "read-only",
     // Headless: the sandbox is the boundary; never pause for a human.
@@ -4748,7 +4752,6 @@ function buildConfig(req, baseInstructionsFile) {
       default_tools_approval_mode: "approve"
     };
   }
-  const policy = codexToolPolicy(req.policy);
   const tmpDir = req.local.env?.TMPDIR;
   const shellEnv = {};
   if (tmpDir) shellEnv.TMPDIR = tmpDir;
@@ -4756,7 +4759,6 @@ function buildConfig(req, baseInstructionsFile) {
     const value = req.local.env?.[key];
     if (value !== void 0) shellEnv[key] = value;
   }
-  const gateLockDir = req.local.env?.CABANE_GATE_LOCK_DIR;
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
@@ -4764,28 +4766,7 @@ function buildConfig(req, baseInstructionsFile) {
     // becomes Codex's base instructions, and Codex's own environment preamble goes
     // with the harness prompt it belonged to.
     ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
-    ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {},
-    ...policy.permissionProfile ? {
-      // CT733: named permission profiles are Codex's split-filesystem path.
-      // `:root = read` preserves coding-mode host reads; the one explicit
-      // workspace-root write grants the checkout, and the more-specific
-      // `.git` write reopens the metadata Codex protects by default. Neither
-      // rule grants an adjacent directory. Do not combine this with legacy `sandbox_mode` /
-      // `sandbox_workspace_write`, which would restore the `.git` carve-out.
-      approval_policy: policy.approvalPolicy,
-      default_permissions: policy.permissionProfile,
-      permissions: {
-        [policy.permissionProfile]: {
-          filesystem: {
-            ":root": "read",
-            ":workspace_roots": { ".": "write", ".git": "write" },
-            // The one absolute-path grant — see the CT612-fallout note above.
-            ...gateLockDir ? { [gateLockDir]: "write" } : {}
-          },
-          network: { enabled: policy.networkAccessEnabled, mode: "full" }
-        }
-      }
-    } : {}
+    ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {}
   };
 }
 function isStringRecord2(v) {
@@ -4799,11 +4780,10 @@ import {
 function buildSdkThreadOptions(spec) {
   return {
     ...spec.model ? { model: spec.model } : {},
-    ...spec.policy.sandboxMode ? { sandboxMode: spec.policy.sandboxMode } : {},
+    sandboxMode: spec.policy.sandboxMode,
     workingDirectory: spec.directory,
     skipGitRepoCheck: spec.skipGitRepoCheck,
-    ...spec.policy.sandboxMode ? { approvalPolicy: spec.policy.approvalPolicy } : {},
-    ...spec.policy.sandboxMode === "workspace-write" ? { networkAccessEnabled: spec.policy.networkAccessEnabled } : {},
+    approvalPolicy: spec.policy.approvalPolicy,
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
@@ -6829,22 +6809,7 @@ ${reason}`,
         }
       }
     }
-    let turnEnv = hookEnv;
-    if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join13(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
-      try {
-        mkdirSync9(tmpDir, { recursive: true });
-        turnEnv = { ...hookEnv, TMPDIR: tmpDir };
-      } catch (err) {
-        turnLog.warn(
-          { err: err instanceof Error ? err.message : String(err), tmpDir },
-          "dispatcher: failed to create per-turn TMPDIR \u2014 proceeding with the inherited temp dir"
-        );
-      }
-    }
-    if (turnContext.runtime === "codex" && process.env.CABANE_GATE_LOCK_DIR) {
-      turnEnv = { ...turnEnv, CABANE_GATE_LOCK_DIR: process.env.CABANE_GATE_LOCK_DIR };
-    }
+    const turnEnv = hookEnv;
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
     this.aborts.set(key, abortController);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.31",
+  "version": "0.6.32",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",