@ccpocket/bridge 1.42.1 → 1.43.1

package/dist/websocket.js

@@ -8,7 +8,7 @@ import { SessionManager, } from "./session.js";
 import { SdkProcess } from "./sdk-process.js";
 import { CodexProcess } from "./codex-process.js";
 import { parseClientMessage, } from "./parser.js";
-import { getAllRecentSessions, getCodexSessionHistory, getSessionHistory, findSessionsByClaudeIds, extractMessageImages, getClaudeSessionName, loadCodexSessionNames, renameClaudeSession, renameCodexSession, } from "./sessions-index.js";
+import { getAllRecentSessions, getCodexSessionHistory, getSessionHistory, findSessionsByClaudeIds, extractMessageImages, getClaudeSessionName, loadCodexSessionNames, renameClaudeSession, renameCodexSession, saveCodexSessionProfile, } from "./sessions-index.js";
 import { ArchiveStore } from "./archive-store.js";
 import { WorktreeStore } from "./worktree-store.js";
 import { listWorktrees, removeWorktree, worktreeExists, getMainBranch, } from "./worktree.js";
@@ -20,7 +20,7 @@ import { PushRelayClient } from "./push-relay.js";
 import { normalizePushLocale, t } from "./push-i18n.js";
 import { fetchAllUsage } from "./usage.js";
 import { getPackageVersion } from "./version.js";
-import { isPathWithinAllowedDirectory, resolvePlatformPath, } from "./path-utils.js";
+import { isPathWithinAllowedDirectory, resolvePlatformPath, resolvePlatformPathFrom, } from "./path-utils.js";
 // ---- Available model lists (delivered to clients via session_list) ----
 const CLAUDE_MODELS = [
     "claude-opus-4-7",
@@ -256,6 +256,25 @@ export class BridgeWebSocketServer {
             errorCode: "path_not_allowed",
         };
     }
+    normalizeAdditionalWritableRoots(roots, projectPath) {
+        if (!roots || roots.length === 0)
+            return {};
+        const normalized = new Map();
+        for (const root of roots) {
+            const trimmed = root.trim();
+            if (!trimmed)
+                continue;
+            const resolved = resolvePlatformPathFrom(projectPath, trimmed, this.platform);
+            if (!this.isPathAllowed(resolved)) {
+                return { deniedRoot: root };
+            }
+            const key = this.platform === "win32" ? resolved.toLowerCase() : resolved;
+            if (!normalized.has(key)) {
+                normalized.set(key, resolved);
+            }
+        }
+        return { roots: [...normalized.values()] };
+    }
     buildSessionCreatedMessage(params) {
         const { sessionId, provider, projectPath, session, permissionMode, executionMode, planMode, approvalsReviewer, sandboxMode, slashCommands, skills, skillMetadata, apps, appMetadata, sourceSessionId, } = params;
         const msg = {
@@ -354,6 +373,10 @@ export class BridgeWebSocketServer {
             if (session.codexSettings.webSearchMode !== undefined) {
                 msg.webSearchMode = session.codexSettings.webSearchMode;
             }
+            if (session.codexSettings.additionalWritableRoots !== undefined) {
+                msg.additionalWritableRoots =
+                    session.codexSettings.additionalWritableRoots;
+            }
         }
         return msg;
     }
@@ -508,6 +531,13 @@ export class BridgeWebSocketServer {
                             break;
                         }
                     }
+                    const additionalWritableRoots = provider === "codex"
+                        ? this.normalizeAdditionalWritableRoots(msg.additionalWritableRoots, projectPath)
+                        : {};
+                    if (additionalWritableRoots.deniedRoot) {
+                        this.send(ws, this.buildPathNotAllowedError(additionalWritableRoots.deniedRoot));
+                        break;
+                    }
                     const cached = provider === "claude"
                         ? this.sessionManager.getCachedCommands(projectPath)
                         : undefined;
@@ -553,6 +583,7 @@ export class BridgeWebSocketServer {
                                 networkAccessEnabled: msg.networkAccessEnabled,
                                 webSearchMode: msg.webSearchMode ??
                                     undefined,
+                                additionalWritableRoots: additionalWritableRoots.roots,
                                 threadId: msg.sessionId,
                                 collaborationMode: planMode
                                     ? "plan"
@@ -927,6 +958,11 @@ export class BridgeWebSocketServer {
                         if (newCollaboration !== currentCollaboration) {
                             process.setCollaborationMode(newCollaboration);
                         }
+                        session.codexSettings = {
+                            ...(session.codexSettings ?? {}),
+                            approvalPolicy: newApproval,
+                            approvalsReviewer: newReviewer,
+                        };
                         session.lastActivityAt = new Date();
                         this.broadcast({
                             type: "system",
@@ -1662,16 +1698,16 @@ export class BridgeWebSocketServer {
                 // Resume flow: keep past history in SessionInfo and deliver it only
                 // via get_history(sessionId) to avoid duplicate/missed replay races.
                 if (provider === "codex") {
-                    if (msg.profile &&
-                        !(await this.validateCodexProfile(msg.profile, resumeProjectPath))) {
-                        this.send(ws, {
-                            type: "error",
-                            message: `Codex profile not found: ${msg.profile}`,
-                        });
-                        break;
-                    }
                     const wtMapping = this.worktreeStore.get(sessionRefId);
                     const effectiveProjectPath = resolvePlatformPath(wtMapping?.projectPath ?? resumeProjectPath, this.platform);
+                    const effectiveProfile = msg.profile
+                        ? await this.resolveCodexResumeProfile(msg.profile, sessionRefId, effectiveProjectPath)
+                        : undefined;
+                    const additionalWritableRoots = this.normalizeAdditionalWritableRoots(msg.additionalWritableRoots, effectiveProjectPath);
+                    if (additionalWritableRoots.deniedRoot) {
+                        this.send(ws, this.buildPathNotAllowedError(additionalWritableRoots.deniedRoot));
+                        break;
+                    }
                     let worktreeOpts;
                     if (wtMapping) {
                         if (worktreeExists(wtMapping.worktreePath)) {
@@ -1691,7 +1727,7 @@ export class BridgeWebSocketServer {
                         .then((pastMessages) => {
                         const sessionId = this.sessionManager.create(effectiveProjectPath, undefined, pastMessages, worktreeOpts, "codex", {
                             threadId: sessionRefId,
-                            profile: msg.profile,
+                            profile: effectiveProfile,
                             approvalPolicy: codexApprovalPolicy ??
                                 normalizeCodexApprovalPolicy(executionMode === "fullAccess" ? "never" : "on-request"),
                             approvalsReviewer: msg.approvalsReviewer,
@@ -1701,6 +1737,7 @@ export class BridgeWebSocketServer {
                             networkAccessEnabled: msg.networkAccessEnabled,
                             webSearchMode: msg.webSearchMode ??
                                 undefined,
+                            additionalWritableRoots: additionalWritableRoots.roots,
                             collaborationMode: planMode
                                 ? "plan"
                                 : "default",
@@ -3075,6 +3112,26 @@ export class BridgeWebSocketServer {
         this.defaultCodexProfile = snapshot.defaultProfile;
         return snapshot.profiles.includes(profile);
     }
+    async resolveCodexResumeProfile(requestedProfile, threadId, projectPath) {
+        const snapshot = await this.loadCodexProfiles(projectPath);
+        this.codexProfiles = snapshot.profiles;
+        this.defaultCodexProfile = snapshot.defaultProfile;
+        if (snapshot.profiles.includes(requestedProfile)) {
+            return requestedProfile;
+        }
+        const fallbackProfile = snapshot.defaultProfile &&
+            snapshot.profiles.includes(snapshot.defaultProfile)
+            ? snapshot.defaultProfile
+            : undefined;
+        console.warn(`[ws] Codex profile not found on resume: ${requestedProfile}; ` +
+            (fallbackProfile
+                ? `falling back to default profile: ${fallbackProfile}`
+                : "falling back to Codex config default"));
+        saveCodexSessionProfile(threadId, fallbackProfile ?? null).catch((err) => {
+            console.warn(`[ws] Failed to update Codex session profile cache: ${err}`);
+        });
+        return fallbackProfile;
+    }
     getActiveCodexProcess() {
         const summary = this.sessionManager
             .list()
@@ -3802,6 +3859,10 @@ export class BridgeWebSocketServer {
             if (session.codexSettings.webSearchMode !== undefined) {
                 msg.webSearchMode = session.codexSettings.webSearchMode;
             }
+            if (session.codexSettings.additionalWritableRoots !== undefined) {
+                msg.additionalWritableRoots =
+                    session.codexSettings.additionalWritableRoots;
+            }
         }
         return msg;
     }