@controlflow-ai/daemon 0.1.1 → 0.1.3

package/src/codex.ts

@@ -1,4 +1,5 @@
-import { buildPalPrompt, runtimeCwd, type AgentRuntime, type AgentRuntimeRunInput } from './agent-runtime.js';
+import { buildPalPrompt, runtimeLaunchRoot, runtimeCwd, type AgentRuntime, type AgentRuntimeRunInput } from './agent-runtime.js';
+import { buildCodexPermissionArgs, buildRuntimeLaunchContext, effectivePermissionProfile, normalizeWritableRoot, writableRootsForProfile, type AgentPermissionProfile, type RuntimeLaunchContext } from './agent-permissions.js';
 export { runAgentRuntime } from './agent-runtime.js';
 
 function extractThreadId(stdout: string): string | null {
@@ -17,19 +18,46 @@ function extractThreadId(stdout: string): string | null {
   return null;
 }
 
-export function makeCodexRuntime(_agentUuid: string): AgentRuntime {
+function tomlString(value: string): string {
+  return JSON.stringify(value);
+}
+
+function codexResumeConfigArgs(profile: AgentPermissionProfile, context: RuntimeLaunchContext): string[] {
+  if (profile.filesystemMode === 'full-access') {
+    return ['-c', 'sandbox_mode="danger-full-access"'];
+  }
+
+  const writableRoots = writableRootsForProfile(profile, context)
+    .filter((root) => normalizeWritableRoot(root) !== normalizeWritableRoot(context.runtimeRoot));
+  const args = [
+    '-c',
+    'sandbox_mode="workspace-write"',
+    '-c',
+    'sandbox_workspace_write.network_access=true',
+  ];
+  if (writableRoots.length > 0) {
+    args.push('-c', `sandbox_workspace_write.writable_roots=[${writableRoots.map(tomlString).join(',')}]`);
+  }
+  return args;
+}
+
+export function makeCodexRuntime(_agentUuid: string, model?: string | null): AgentRuntime {
+  const modelArgs = model?.trim() ? ['--model', model.trim()] : [];
   return {
     name: 'codex',
-    capabilities: { protocol: 'json-stream', resume: 'runtime-session-id', busyDeliveryMode: 'queue', supportsMcp: false },
+    capabilities: { protocol: 'json-stream', resume: 'runtime-session-id', busyDeliveryMode: 'queue', supportsMcp: false, supportsSteer: false },
     command: 'codex',
     buildPrompt: buildPalPrompt,
     buildCwd: runtimeCwd,
     buildArgs(input: AgentRuntimeRunInput): string[] {
       const prompt = buildPalPrompt(input);
+      const context = input.launchContext ?? buildRuntimeLaunchContext(input);
+      const permissionProfile = effectivePermissionProfile(input);
+      const permissionArgs = buildCodexPermissionArgs(permissionProfile, context);
       if (input.runtimeSessionId) {
-        return ['exec', 'resume', '--json', '--dangerously-bypass-approvals-and-sandbox', ...input.extraArgs, input.runtimeSessionId, prompt];
+        return ['exec', 'resume', '--json', '--skip-git-repo-check', ...codexResumeConfigArgs(permissionProfile, context), ...modelArgs, ...input.extraArgs, input.runtimeSessionId, prompt];
       }
-      return ['exec', '--json', '--dangerously-bypass-approvals-and-sandbox', '--cd', runtimeCwd(input), ...input.extraArgs, prompt];
+      return ['exec', '--json', ...permissionArgs, '--skip-git-repo-check', '--cd', runtimeLaunchRoot(input), ...modelArgs, ...input.extraArgs, prompt];
     },
     parseOutput({ stdout, stderr, input }) {
       return {

package/src/config.ts

@@ -96,11 +96,35 @@ export function privatePalCliBinDir(): string {
   return join(homeDir(), 'bin');
 }
 
-export function ensurePrivatePalCliBin(): string {
+export interface EnsurePrivatePalCliBinOptions {
+  platform?: NodeJS.Platform;
+}
+
+function cmdQuoted(path: string): string {
+  return `"${path.replace(/"/g, '""')}"`;
+}
+
+function psQuoted(path: string): string {
+  return `'${path.replace(/'/g, "''")}'`;
+}
+
+export function privatePalCliExecutableName(platform: NodeJS.Platform = process.platform): string {
+  return platform === 'win32' ? 'pal.cmd' : 'pal';
+}
+
+export function ensurePrivatePalCliBin(options: EnsurePrivatePalCliBinOptions = {}): string {
+  const platform = options.platform ?? process.platform;
   const binDir = privatePalCliBinDir();
   ensureDir(binDir);
-  const linkPath = join(binDir, 'pal');
-  rmSync(linkPath, { force: true });
-  symlinkSync(repoCliPath(), linkPath);
+  const cliPath = repoCliPath();
+  for (const name of ['pal', 'pal.cmd', 'pal.ps1']) {
+    rmSync(join(binDir, name), { force: true });
+  }
+  if (platform === 'win32') {
+    writeFileSync(join(binDir, 'pal.cmd'), `@echo off\r\nbun ${cmdQuoted(cliPath)} %*\r\n`);
+    writeFileSync(join(binDir, 'pal.ps1'), `& bun ${psQuoted(cliPath)} @args\r\n`);
+  } else {
+    symlinkSync(cliPath, join(binDir, 'pal'));
+  }
   return binDir;
 }