@enderfga/claw-orchestrator 4.10.0 → 4.10.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/dist/src/persistent-codex-session.js +11 -5
- package/dist/src/persistent-codex-session.js.map +1 -1
- package/dist/src/persistent-opencode-session.js +24 -3
- package/dist/src/persistent-opencode-session.js.map +1 -1
- package/package.json +1 -1
- package/skills/references/multi-engine.md +3 -2
package/README.md
CHANGED
|
@@ -92,10 +92,10 @@ Register `clawo-mcp` with any MCP-compatible host: Hermes Agent, Claude Desktop,
|
|
|
92
92
|
| Engine | CLI | Tested Version |
|
|
93
93
|
| ------------ | ---------- | -------------- |
|
|
94
94
|
| Claude Code | `claude` | 2.1.220 |
|
|
95
|
-
| Codex | `codex` | 0.
|
|
96
|
-
| Antigravity | `agy` | 1.1.
|
|
95
|
+
| Codex | `codex` | 0.146.0 |
|
|
96
|
+
| Antigravity | `agy` | 1.1.8 |
|
|
97
97
|
| Cursor Agent | `agent` | 2026.07.23-e383d2b |
|
|
98
|
-
| OpenCode | `opencode` | 1.18.
|
|
98
|
+
| OpenCode | `opencode` | 1.18.9 |
|
|
99
99
|
| Custom CLI | any | — |
|
|
100
100
|
|
|
101
101
|
Any coding CLI that runs as a subprocess can be wired up as a custom engine — see [`multi-engine.md`](./skills/references/multi-engine.md#custom-engine-enginecustom).
|
|
@@ -57,15 +57,21 @@ export class PersistentCodexSession extends BaseOneShotSession {
|
|
|
57
57
|
_buildArgs(message) {
|
|
58
58
|
const args = ['exec'];
|
|
59
59
|
const isResume = !!this.codexThreadId;
|
|
60
|
+
const sandbox = this.options.sandboxMode || 'workspace-write';
|
|
60
61
|
if (isResume) {
|
|
61
|
-
// `codex exec resume` rejects --sandbox and -C
|
|
62
|
-
//
|
|
63
|
-
//
|
|
64
|
-
//
|
|
62
|
+
// `codex exec resume` rejects --sandbox and -C (still true as of 0.146.0:
|
|
63
|
+
// passing --sandbox errors with "unexpected argument"), so the policy has
|
|
64
|
+
// to be restated as a `-c` config override, which resume does accept.
|
|
65
|
+
//
|
|
66
|
+
// Do NOT rely on the resumed thread inheriting the first turn's sandbox.
|
|
67
|
+
// It does not: against 0.146.0, a read-only session whose first turn was
|
|
68
|
+
// spawned with `--sandbox read-only` wrote to disk on the very next turn,
|
|
69
|
+
// reproducibly, when resume was left to inherit. Restating the mode keeps
|
|
70
|
+
// a read-only session read-only for its whole life.
|
|
65
71
|
args.push('resume', this.codexThreadId, '--skip-git-repo-check', '--json');
|
|
72
|
+
args.push('-c', `sandbox_mode="${sandbox}"`);
|
|
66
73
|
}
|
|
67
74
|
else {
|
|
68
|
-
const sandbox = this.options.sandboxMode || 'workspace-write';
|
|
69
75
|
args.push('--sandbox', sandbox, '--skip-git-repo-check', '--json');
|
|
70
76
|
if (this.options.cwd)
|
|
71
77
|
args.push('-C', this.options.cwd);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"persistent-codex-session.js","sourceRoot":"","sources":["../../src/persistent-codex-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAoC/D,+EAA+E;AAE/E,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5D;;;OAGG;IACK,aAAa,CAAU;IAE/B;;;;;OAKG;IACK,eAAe,CAAU;IAEjC,YAAY,MAAqB,EAAE,QAAiB;QAClD,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,EAAE;YAC1D,YAAY,EAAE,OAAO;YACrB,YAAY,EAAE,SAAS;YACvB,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,OAAO;SAC3B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,OAAe;QAChC,MAAM,IAAI,GAAa,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACb,
|
|
1
|
+
{"version":3,"file":"persistent-codex-session.js","sourceRoot":"","sources":["../../src/persistent-codex-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAoC/D,+EAA+E;AAE/E,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5D;;;OAGG;IACK,aAAa,CAAU;IAE/B;;;;;OAKG;IACK,eAAe,CAAU;IAEjC,YAAY,MAAqB,EAAE,QAAiB;QAClD,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,EAAE;YAC1D,YAAY,EAAE,OAAO;YACrB,YAAY,EAAE,SAAS;YACvB,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,OAAO;SAC3B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,OAAe;QAChC,MAAM,IAAI,GAAa,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,EAAE;YACF,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,oDAAoD;YACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAc,EAAE,uBAAuB,EAAE,QAAQ,CAAC,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,OAAO,GAAG,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC1C,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,gDAAgD;QAChD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAA2B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACjH,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,0BAA0B,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACK,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAC/C,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAEkB,YAAY;QAC7B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;YACD,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,YAAY,EAAE,CAAC;IACvB,CAAC;IAES,IAAI,CAAC,OAAe,EAAE,OAA2B;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;QAE3C,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,IAAI,SAAkD,CAAC;YACvD,IAAI,SAA6B,CAAC;YAClC,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE;gBACvC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;gBACrB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;gBACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAExB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrB,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;oBAChE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,kBAAkB,OAAO,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,MAAM,EAAE,GAAG,KAA0B,CAAC;gBACtC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;oBAChB,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,MAAM,CAAC,GAAG,KAA2B,CAAC;wBACtC,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,SAAS,CAAC;wBACnC,CAAC;wBACD,MAAM;oBACR,CAAC;oBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,MAAM,EAAE,GAAG,KAA2B,CAAC;wBACvC,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;wBAC/B,IAAI,QAAQ,KAAK,eAAe,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BACrE,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;4BAC3B,aAAa,IAAI,KAAK,CAAC;4BACvB,IAAI,CAAC;gCACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,sCAAsC;4BACxC,CAAC;4BACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBACvC,CAAC;6BAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;4BACpC,wEAAwE;4BACxE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,qBAAqB,OAAO,EAAE,CAAC,CAAC;wBAC/D,CAAC;6BAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;4BACpC,yEAAyE;4BACzE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,OAAO,EAAE,CAAC,CAAC;wBAC1D,CAAC;6BAAM,CAAC;4BACN,mFAAmF;4BACnF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;4BACxB,IACE,QAAQ,KAAK,mBAAmB;gCAChC,OAAO,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;gCACrC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,EACvB,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;4BAC3B,CAAC;4BACD,IAAI,CAAC;gCACH,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC;4BACxC,CAAC;4BAAC,MAAM,CAAC;gCACP,qBAAqB;4BACvB,CAAC;4BACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,OAAO,EAAE,CAAC,CAAC;wBAC1D,CAAC;wBACD,MAAM;oBACR,CAAC;oBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,MAAM,EAAE,GAAG,KAA2B,CAAC;wBACvC,IAAI,EAAE,CAAC,KAAK;4BAAE,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC;wBACnC,MAAM;oBACR,CAAC;oBACD,KAAK,aAAa,CAAC,CAAC,CAAC;wBACnB,MAAM,EAAE,GAAG,KAAwB,CAAC;wBACpC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO;4BAAE,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;wBACpD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAC;wBACzD,MAAM;oBACR,CAAC;oBACD,KAAK,OAAO,CAAC,CAAC,CAAC;wBACb,MAAM,EAAE,GAAG,KAAmB,CAAC;wBAC/B,IAAI,EAAE,CAAC,OAAO;4BAAE,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;wBACvC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAC;wBACzD,MAAM;oBACR,CAAC;oBACD;wBACE,gEAAgE;wBAChE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC,CAAC;YAEF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,IAAI,EAAU,CAAC;gBACf,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBACpC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,kBAAkB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBAExB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBAEf,oDAAoD;gBACpD,IAAI,SAAS,CAAC,IAAI,EAAE;oBAAE,WAAW,CAAC,SAAS,CAAC,CAAC;gBAE7C,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAE3B,mEAAmE;gBACnE,oEAAoE;gBACpE,2BAA2B;gBAC3B,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,IAAI,CAAC,CAAC;oBACpD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC;oBACnG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,mBAAmB,IAAI,CAAC,CAAC;gBACjE,CAAC;gBACD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEhD,MAAM,KAAK,GAAgB;oBACzB,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,aAAa;oBACrB,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;oBAC9C,UAAU,EAAE,IAAI,CAAC,aAAa;iBAC/B,CAAC;gBAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBAE9C,uEAAuE;gBACvE,sEAAsE;gBACtE,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC/B,CAAC;qBAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,0BAA0B,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,QAAQ;QACN,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IACxD,CAAC;CACF"}
|
|
@@ -45,9 +45,13 @@ import { BaseOneShotSession } from './base-oneshot-session.js';
|
|
|
45
45
|
* stock install its rules begin with `{"permission":"*","action":"allow"}` and
|
|
46
46
|
* deny neither `bash` nor `edit`, so a "read-only" session could still author
|
|
47
47
|
* files through a shell heredoc. We therefore define our own agent and hand it
|
|
48
|
-
* to the CLI via `OPENCODE_CONFIG_CONTENT
|
|
49
|
-
*
|
|
50
|
-
*
|
|
48
|
+
* to the CLI via `OPENCODE_CONFIG_CONTENT`, with the write paths denied at the
|
|
49
|
+
* permission-engine level AND the corresponding tools removed.
|
|
50
|
+
*
|
|
51
|
+
* Verify this config only with adversarial writes, and include prompts that ask
|
|
52
|
+
* the agent to delegate — `opencode agent list` renders compiled rules that look
|
|
53
|
+
* identical for a safe and an unsafe agent, and a probe that only asks the agent
|
|
54
|
+
* to write directly passes even when the delegation path is wide open.
|
|
51
55
|
*/
|
|
52
56
|
const READ_ONLY_AGENT = 'clawo-readonly';
|
|
53
57
|
const READ_ONLY_AGENT_CONFIG = JSON.stringify({
|
|
@@ -58,6 +62,23 @@ const READ_ONLY_AGENT_CONFIG = JSON.stringify({
|
|
|
58
62
|
edit: 'deny',
|
|
59
63
|
bash: 'deny',
|
|
60
64
|
external_directory: 'deny',
|
|
65
|
+
// Denying the write tools is not enough on its own: the agent can hand
|
|
66
|
+
// the work to a subagent via `task`, and the subagent runs under the
|
|
67
|
+
// default (writable) agent, so the denials above never apply to it.
|
|
68
|
+
// Asked to "delegate this to a subagent", a session denied only
|
|
69
|
+
// edit/bash/external_directory wrote to disk on every attempt.
|
|
70
|
+
task: 'deny',
|
|
71
|
+
webfetch: 'deny',
|
|
72
|
+
},
|
|
73
|
+
// Belt-and-suspenders: drop the tools outright as well, so enforcement
|
|
74
|
+
// does not depend on the permission engine resolving our rules the way we
|
|
75
|
+
// expect. `task` is the escalation path; the rest are the direct ones.
|
|
76
|
+
tools: {
|
|
77
|
+
task: false,
|
|
78
|
+
write: false,
|
|
79
|
+
edit: false,
|
|
80
|
+
bash: false,
|
|
81
|
+
patch: false,
|
|
61
82
|
},
|
|
62
83
|
},
|
|
63
84
|
},
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"persistent-opencode-session.js","sourceRoot":"","sources":["../../src/persistent-opencode-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D
|
|
1
|
+
{"version":3,"file":"persistent-opencode-session.js","sourceRoot":"","sources":["../../src/persistent-opencode-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,eAAe,GAAG,gBAAgB,CAAC;AACzC,MAAM,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC;IAC5C,KAAK,EAAE;QACL,CAAC,eAAe,CAAC,EAAE;YACjB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE;gBACV,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,MAAM;gBACZ,kBAAkB,EAAE,MAAM;gBAC1B,uEAAuE;gBACvE,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,+DAA+D;gBAC/D,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,MAAM;aACjB;YACD,uEAAuE;YACvE,0EAA0E;YAC1E,uEAAuE;YACvE,KAAK,EAAE;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,KAAK;aACb;SACF;KACF;CACF,CAAC,CAAC;AAYH,+EAA+E;AAE/E,MAAM,OAAO,yBAA0B,SAAQ,kBAAkB;IACvD,UAAU,GAA8B,IAAI,CAAC;IAErD,YAAY,MAAqB,EAAE,WAAoB;QACrD,KAAK,CAAC,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,UAAU,EAAE;YACnE,YAAY,EAAE,UAAU;YACxB,YAAY,EAAE,mBAAmB;YACjC,mBAAmB,EAAE,kBAAkB;YACvC,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,UAAU;SAC9B,CAAC,CAAC;IACL,CAAC;IAEkB,YAAY;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,YAAY,EAAE,CAAC;IACvB,CAAC;IAES,IAAI,CAAC,OAAe,EAAE,OAA2B;QACzD,yCAAyC;QACzC,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,oDAAoD;YACpD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACxC,CAAC;QAED,iFAAiF;QACjF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;QAE3C,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,KAAK,GAAc;gBACvB,SAAS,EAAE,IAAI,GAAG,EAAE;gBACpB,SAAS,EAAE,IAAI,GAAG,EAAE;gBACpB,YAAY,EAAE,IAAI,GAAG,EAAE;gBACvB,QAAQ,EAAE,KAAK;aAChB,CAAC;YACF,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,yEAAyE;YACzE,wEAAwE;YACxE,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI,oBAAoB,GAAG,KAAK,CAAC;YAEjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE;gBACvC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;gBACrB,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;gBACxG,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,iEAAiE;YACjE,8DAA8D;YAC9D,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YAElB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrB,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;YACrB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;oBAAE,OAAO;gBACzB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;oBAC1D,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,sEAAsE;oBACtE,IAAI,QAAQ,IAAI,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1E,oBAAoB,GAAG,IAAI,CAAC;oBAC9B,CAAC;oBACD,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;oBAC7B,uEAAuE;oBACvE,sEAAsE;oBACtE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;oBACtF,IAAI,CAAC;wBACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;oBACxC,CAAC;oBAAC,MAAM,CAAC;wBACP,sBAAsB;oBACxB,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,SAAS,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,qBAAqB,SAAS,EAAE,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;oBACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACzB,CAAC;gBAED,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBAEf,2EAA2E;gBAC3E,sEAAsE;gBACtE,gCAAgC;gBAChC,IAAI,oBAAoB,EAAE,CAAC;oBACzB,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC3B,MAAM,CACJ,IAAI,KAAK,CACP,iGAAiG;wBAC/F,sGAAsG;wBACtG,4BAA4B,CAC/B,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,0EAA0E;gBAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAEhE,iDAAiD;gBACjD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;gBAElD,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAE3B,0DAA0D;gBAC1D,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;oBAChD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;oBACnD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,CAAC;gBAED,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE5C,MAAM,KAAK,GAAgB;oBACzB,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;iBAC/C,CAAC;gBAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBAE9C,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,6BAA6B,IAAI,EAAE,CAAC,CAAC,CAAC;gBACnE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAEjE,kBAAkB,CAAC,KAA8B,EAAE,OAA2B,EAAE,KAAgB;QACtG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAc,CAAC;QAElC,oEAAoE;QACpE,MAAM,GAAG,GAAI,KAAK,CAAC,SAAoB,IAAK,KAAK,CAAC,SAAoB,IAAK,KAAK,CAAC,UAAqB,CAAC;QACvG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,SAAS,GAAG,iBAAiB,GAAG,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAA2C,CAAC;QAE/D,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACjB,MAAM,IAAI,GAAI,IAAI,CAAC,IAAe,IAAI,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAI,IAAI,CAAC,EAAa,IAAI,QAAQ,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC/C,IAAI,IAAI,KAAK,IAAI;oBAAE,MAAM;gBACzB,kEAAkE;gBAClE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAClC,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC;wBACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;oBACrC,CAAC;oBAAC,MAAM,CAAC;wBACP,sBAAsB;oBACxB,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvC,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,qEAAqE;gBACrE,kEAAkE;gBAClE,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACjB,MAAM,IAAI,GAAI,IAAI,CAAC,IAAe,IAAI,EAAE,CAAC;gBACzC,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,IAAI,EAAE,CAAC,CAAC;gBACvE,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACjB,MAAM,MAAM,GAAI,IAAI,CAAC,MAAiB,IAAK,IAAI,CAAC,EAAa,IAAI,EAAE,CAAC;gBACpE,IAAI,CAAC,MAAM;oBAAE,MAAM;gBACnB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC5B,IAAI,CAAC;wBACH,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC;oBACxC,CAAC;oBAAC,MAAM,CAAC;wBACP,sBAAsB;oBACxB,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC3C,CAAC;gBACD,0EAA0E;gBAC1E,8CAA8C;gBAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAA4C,CAAC;gBACpE,MAAM,MAAM,GAAG,SAAS,EAAE,MAA4B,CAAC;gBACvD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1D,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC;gBACD,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;oBACjD,IAAI,CAAC;wBACH,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC;oBAC3C,CAAC;oBAAC,MAAM,CAAC;wBACP,sBAAsB;oBACxB,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;gBAC9C,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,YAAY;gBACf,gCAAgC;gBAChC,MAAM;YAER,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAEP,CAAC;gBACd,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;oBAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;oBAC5C,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI;wBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;oBACtE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,OAAO;gBACV,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,oBAAoB,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzF,MAAM;YAER;gBACE,yDAAyD;gBACzD,MAAM;QACV,CAAC;IACH,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@enderfga/claw-orchestrator",
|
|
3
|
-
"version": "4.10.
|
|
3
|
+
"version": "4.10.1",
|
|
4
4
|
"description": "Claw Orchestrator — run Claude Code, Codex, Gemini, Cursor Agent, OpenCode and custom coding CLIs as one unified runtime. Drop into Hermes Agent, Claude Desktop, Cursor, Cline, Continue, Zed, Windsurf, Goose or any Model Context Protocol (MCP) host, install as an OpenClaw plugin, or run standalone. Persistent sessions, multi-agent council, ultraplan, ultrareview, autoloop, tool orchestration.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/src/index.js",
|
|
@@ -52,7 +52,7 @@ await manager.startSession({
|
|
|
52
52
|
|
|
53
53
|
### OpenAI Codex (`engine: 'codex'`)
|
|
54
54
|
|
|
55
|
-
Wraps the `codex exec` subcommand. Each `send()` spawns a new process. Tested with `codex` CLI **0.
|
|
55
|
+
Wraps the `codex exec` subcommand. Each `send()` spawns a new process. Tested with `codex` CLI **0.146.0**.
|
|
56
56
|
|
|
57
57
|
- Non-interactive execution via `codex exec --sandbox workspace-write --json` (replaces the deprecated `--full-auto` flag from earlier Codex versions)
|
|
58
58
|
- Real per-turn `usage` from the `turn.completed` JSON event (input, output, cached, reasoning tokens)
|
|
@@ -60,6 +60,7 @@ Wraps the `codex exec` subcommand. Each `send()` spawns a new process. Tested wi
|
|
|
60
60
|
- Reasoning effort: the engine-agnostic `effort` maps to `-c model_reasoning_effort=<level>` (`max`→`xhigh`; `auto`/`ultracode` omitted)
|
|
61
61
|
- `codexProfile` → `--profile <name>` (named config profile from `~/.codex/config.toml`)
|
|
62
62
|
- Per-session continuity: the `thread_id` from the first turn's `thread.started` event is captured and reused via `codex exec resume <id>` for subsequent sends, so the model sees prior turns
|
|
63
|
+
- `sandboxMode` maps to `--sandbox <mode>` on the first turn. **A resumed thread does not inherit it**, and `codex exec resume` rejects `--sandbox`, so the policy is restated as `-c sandbox_mode="<mode>"` on every resume. Without that, a `read-only` session goes writable from its second turn onward — verified against 0.146.0, where such a session wrote to disk on turn 2 on every attempt
|
|
63
64
|
- One-shot execution per message (no persistent subprocess between sends)
|
|
64
65
|
- Captures the real Codex thread ID and persists it, so later sends and process-level session resume use `codex exec resume <thread_id>`
|
|
65
66
|
- Working directory passed via `-C` flag
|
|
@@ -186,7 +187,7 @@ Wraps the [sst/opencode](https://github.com/sst/opencode) CLI with `run --format
|
|
|
186
187
|
- Real token counts from `step_finish.part.tokens.{input,output,cache.read}`
|
|
187
188
|
- The wrapper closes the subprocess's stdin immediately after spawn (opencode otherwise reads stdin and blocks on EOF, hanging the call)
|
|
188
189
|
- Provider-agnostic: opencode's `--model` expects `provider/model` form (e.g. `anthropic/claude-sonnet-4`). The wrapper passes `--model` through only when the value contains a `/`; otherwise opencode's own default applies
|
|
189
|
-
- `sandboxMode: 'read-only'` spawns a generated `clawo-readonly` agent (`--agent clawo-readonly` plus an `OPENCODE_CONFIG_CONTENT` env var defining it)
|
|
190
|
+
- `sandboxMode: 'read-only'` spawns a generated `clawo-readonly` agent (`--agent clawo-readonly` plus an `OPENCODE_CONFIG_CONTENT` env var defining it) that denies `edit` / `bash` / `external_directory` / `webfetch` / **`task`** at the permission level and additionally removes those tools outright via the agent's `tools` map. It deliberately does **not** use OpenCode's built-in `plan` agent: that is a user-overridable preset whose compiled rules start with `{"permission":"*","action":"allow"}` and deny neither `bash` nor `edit`, so a "read-only" session could still author files through a shell heredoc. **`task` is the load-bearing denial**: denying only the write tools leaves the delegation path open, and the agent will hand the write to a subagent that runs under the default writable agent — asked to delegate, a session denied only `edit`/`bash`/`external_directory` wrote to disk on every attempt. Verify this config only with adversarial writes, and include prompts that ask the agent to delegate; `opencode agent list` renders compiled permission rules that look identical for a safe and an unsafe agent, and a probe that only asks for a direct write passes even when the delegation path is wide open
|
|
190
191
|
- Requires opencode installed: `brew install sst/tap/opencode` or `npm install -g opencode-ai`. Auth via `opencode auth login` **or** any provider env var (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, etc.) — opencode picks up either path
|
|
191
192
|
- Binary: `opencode` (set `OPENCODE_BIN` env var to override)
|
|
192
193
|
|