@chibitek/chibi 0.1.169 → 0.1.171

package/dist-server/server/drivers/codex.js

@@ -1,3 +1,4 @@
+import { namedApprovalParams } from "./codex-approval-presets.js";
 import { codexToolSurfaceArgs } from "./codex-tool-surface.js";
 import { codexImage } from "./codex-image.js";
 // Official Codex app-server over newline-delimited JSON-RPC on stdio.
@@ -183,40 +184,6 @@ function additionalPermissionSummary(permissions, reason) {
 const plainRecord = (value) => value && typeof value === "object" && !Array.isArray(value)
     ? value
     : null;
-/** Codex persists these values on its native thread. Keep them explicit on
- * start, resume, and every turn so switching modes cannot leave a more
- * permissive sandbox/reviewer stuck to the next request. */
-/** Ask and Edits both run Codex's workspace-write sandbox with the person as
- * reviewer: Codex has no narrower "edits only" mode, so the selector never
- * offers Edits for it (supportsApprovalMode) and a stray value asks. */
-function namedApprovalParams(mode) {
-    if (mode === "full") {
-        return {
-            thread: {
-                approvalPolicy: "never",
-                approvalsReviewer: "user",
-                sandbox: "danger-full-access",
-            },
-            turn: {
-                approvalPolicy: "never",
-                approvalsReviewer: "user",
-                sandboxPolicy: { type: "dangerFullAccess" },
-            },
-        };
-    }
-    return {
-        thread: {
-            approvalPolicy: "on-request",
-            approvalsReviewer: mode === "auto" ? "auto_review" : "user",
-            sandbox: "workspace-write",
-        },
-        turn: {
-            approvalPolicy: "on-request",
-            approvalsReviewer: mode === "auto" ? "auto_review" : "user",
-            sandboxPolicy: { type: "workspaceWrite" },
-        },
-    };
-}
 /** Linked repos besides the working folder become extra writable roots of
  * Codex's workspace-write sandbox (the app-server's equivalent of the CLI's
  * --add-dir). Full access already reaches them; read-only and a named
@@ -559,6 +526,9 @@ export const CodexDriver = {
             // instance's legacy fullAuto setting. Harness turns always send an
             // explicit mode, which takes precedence.
             const approvalMode = turn.approvalMode ?? (config.fullAuto ? "full" : "ask");
+            // Plan has no MCP/harness tools, even when a user opted into native MCP.
+            if (approvalMode === "plan")
+                turn = { ...turn, integrations: undefined, mcpFromUserConfig: false };
             // The person's servers this turn mounts. One that would clobber a
             // harness-owned variable is left out, not fatal: the rest still mount.
             const customServers = {};
@@ -627,7 +597,7 @@ export const CodexDriver = {
                 // The harness's own mounts above are never switched off by this.
                 if (!turn.mcpFromUserConfig) {
                     const harnessMounts = new Set(["openmausbot_connectors", "atomic_accounts", "agents", "computer", "browser", "openmausbot_phone"]);
-                    appServerArgs.push(...codexUserMcpOffArgs(new Map([...declaredInCodexConfig].filter(([name]) => !harnessMounts.has(name)))));
+                    appServerArgs.push(...codexUserMcpOffArgs(new Map([...declaredInCodexConfig].filter(([name]) => approvalMode === "plan" || !harnessMounts.has(name)))));
                     // Same rule for the person's plugins (a `git ls-remote` per Git
                     // marketplace at every start) and personal skills (listed in the
                     // model's context on every call). Sign-in is untouched.
@@ -656,6 +626,8 @@ export const CodexDriver = {
                     const prefix = "mcp_servers.openmausbot_phone";
                     appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
                 }
+                if (approvalMode === "plan")
+                    appServerArgs.push("-c", 'web_search="disabled"', "-c", "features.apps=false", "-c", "features.multi_agent=false");
                 const child = spawnCli(config.cli, appServerArgs, {
                     cwd: childCwd,
                     env,
@@ -925,6 +897,10 @@ export const CodexDriver = {
                             : isAdditionalPermission
                                 ? { permissions: allow ? grantedPermissions(params.permissions) : {}, scope: "turn" }
                                 : { decision: allow ? (legacy ? "approved" : "accept") : legacy ? "denied" : "decline" };
+                    if (approvalMode === "plan" && isPermission) {
+                        send({ jsonrpc: "2.0", id: msg.id, result: permissionResult(false) });
+                        return;
+                    }
                     if (autoAcceptPermissions && isPermission && !serverConfirm) {
                         return send({
                             jsonrpc: "2.0",

package/dist-server/server/drivers/openai-chat.js

@@ -1,3 +1,4 @@
+import { PLAN_REFUSAL } from "../plan-policy.js";
 import { newEventId, newId } from "../contracts.js";
 import { redactSecretsInText } from "../redact.js";
 import { toolDetailPreview } from "../tool-summary.js";
@@ -423,8 +424,8 @@ export function createOpenAIChatRuntime(options) {
                             // so it is honoured here: without it every single tool call on
                             // an OpenAI-compatible engine stops for a card, and a Chief's
                             // delegated Full access cannot help either.
-                            const allowed = turn.approvalMode === "full"
-                                || await approval.ask(call.function.name, inputPreview ?? "This tool has no arguments.", tools.customTool?.(call.function.name));
+                            const allowed = (turn.approvalMode !== "plan" || tools.planReadOnly?.(call.function.name) === true) && (turn.approvalMode === "full"
+                                || await approval.ask(call.function.name, inputPreview ?? "This tool has no arguments.", tools.customTool?.(call.function.name)));
                             abort.signal.throwIfAborted();
                             emit({ ...base(turn.threadId, turnId), type: "item.started", itemType: "tool", itemId: call.id,
                                 title: call.function.name, ...(inputPreview ? { input: inputPreview } : {}),
@@ -444,7 +445,7 @@ export function createOpenAIChatRuntime(options) {
                             }
                             else {
                                 denials.push(call.function.name);
-                                result = { ok: false, text: "Permission denied or expired; the tool was not executed." };
+                                result = { ok: false, text: turn.approvalMode === "plan" && tools.planReadOnly?.(call.function.name) !== true ? PLAN_REFUSAL : "Permission denied or expired; the tool was not executed." };
                             }
                         }
                         catch (error) {

package/dist-server/server/hooks/plan-hook.js

@@ -0,0 +1,17 @@
+// Atomic Engineering, 2026-10-31. Claude PreToolUse Plan guard.
+import { readFileSync } from "node:fs";
+import { planToolAllowed, PLAN_REFUSAL } from "../plan-policy.js";
+try {
+    const event = JSON.parse(readFileSync(0, "utf8"));
+    if (event.hook_event_name === "PreToolUse" && planToolAllowed(event.tool_name)) {
+        // No permission override: reads still obey Claude's normal access checks.
+    }
+    else {
+        process.stderr.write(PLAN_REFUSAL);
+        process.exitCode = 2;
+    }
+}
+catch {
+    process.stderr.write(PLAN_REFUSAL);
+    process.exitCode = 2;
+}