@golba98/codexa 1.0.1

package/src/core/cleanupFastFail.test.ts

@@ -0,0 +1,76 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { RunToolActivity } from "../session/types.js";
+import { getBlockedCleanupFailure } from "./cleanupFastFail.js";
+
+function activity(overrides: Partial<RunToolActivity>): RunToolActivity {
+  return {
+    id: "tool-1",
+    command: "Remove-Item -Recurse __pycache__",
+    status: "failed",
+    startedAt: 1,
+    completedAt: 2,
+    ...overrides,
+  };
+}
+
+test("reports access-denied Remove-Item cleanup failures", () => {
+  const result = getBlockedCleanupFailure(activity({
+    summary: "Access to the path 'C:\\repo\\__pycache__\\mod.pyc' is denied.",
+  }));
+
+  assert.match(result ?? "", /access denied/i);
+  assert.match(result ?? "", /C:\\repo\\__pycache__\\mod\.pyc/);
+  assert.match(result ?? "", /stopped/i);
+});
+
+test("reports generic POSIX and node locked delete failures", () => {
+  for (const summary of [
+    "rm: cannot remove 'tests/__pycache__/case.pyc': Permission denied",
+    "EPERM: operation not permitted, unlink 'tests/__pycache__/case.pyc'",
+    "EACCES: permission denied, rmdir 'tests/__pycache__'",
+    "EBUSY: resource busy or locked, unlink 'tests/__pycache__/case.pyc'",
+    "The process cannot access the file because it is being used by another process: 'tests/__pycache__/case.pyc'",
+  ]) {
+    const result = getBlockedCleanupFailure(activity({
+      command: "rm -rf tests/__pycache__",
+      summary,
+    }));
+
+    assert.ok(result, `Expected blocked cleanup failure for: ${summary}`);
+    assert.match(result, /blocked|denied|locked|busy/i);
+  }
+});
+
+test("reports git and generic lock artifacts during delete failures", () => {
+  const gitLock = getBlockedCleanupFailure(activity({
+    command: "Remove-Item -LiteralPath .git\\config.lock",
+    summary: "Access to the path '.git\\config.lock' is denied.",
+  }));
+  const genericLock = getBlockedCleanupFailure(activity({
+    command: "del cache.lock",
+    summary: "EPERM: operation not permitted, unlink 'cache.lock'",
+  }));
+
+  assert.match(gitLock ?? "", /lock artifact/i);
+  assert.match(gitLock ?? "", /\.git\\config\.lock/i);
+  assert.match(genericLock ?? "", /lock artifact/i);
+  assert.match(genericLock ?? "", /cache\.lock/i);
+});
+
+test("ignores non-delete failures and non-failed activities", () => {
+  assert.equal(getBlockedCleanupFailure(activity({
+    command: "git status",
+    summary: "fatal: Unable to create '.git/config.lock': File exists.",
+  })), null);
+
+  assert.equal(getBlockedCleanupFailure(activity({
+    status: "completed",
+    summary: "Access to the path 'x.pyc' is denied.",
+  })), null);
+
+  assert.equal(getBlockedCleanupFailure(activity({
+    command: "rm -rf __pycache__",
+    summary: "No such file or directory",
+  })), null);
+});

package/src/core/cleanupFastFail.ts

@@ -0,0 +1,67 @@
+import type { RunToolActivity } from "../session/types.js";
+
+const DELETE_COMMAND_PATTERN =
+  /(?:^|[\s;&|])(?:remove-item|rm|rmdir|del|erase|unlink)\b/i;
+
+const BLOCKED_DELETE_CAUSE_PATTERNS: Array<{ pattern: RegExp; label: string }> = [
+  { pattern: /(?:^|[\\/])\.git[\\/][^\s"'`]*\.lock\b|(?:^|[\\/])?config\.lock\b|\.lock\b/i, label: "lock artifact" },
+  { pattern: /\bEACCES\b/i, label: "access denied" },
+  { pattern: /\bEPERM\b/i, label: "permission denied" },
+  { pattern: /\bEBUSY\b/i, label: "file is busy or locked" },
+  { pattern: /access(?:\s+to\s+the\s+path)?\s+.*?\s+denied|access is denied/i, label: "access denied" },
+  { pattern: /permission denied|operation not permitted/i, label: "permission denied" },
+  { pattern: /being used by another process|file is in use|resource busy|text file busy|device or resource busy/i, label: "file is locked or in use" },
+];
+
+const PATH_PATTERNS = [
+  /Access to the path ['"]([^'"]+)['"] is denied/i,
+  /(?:EPERM|EACCES|EBUSY)[^,\n\r]*,\s*(?:unlink|rmdir|rm|open|scandir)\s+['"]?([^'"\n\r]+)['"]?/i,
+  /(?:cannot|can't|failed to|unable to)\s+(?:remove|delete|unlink|rmdir)[^'"\n\r]*['"]([^'"]+)['"]/i,
+  /(?:being used by another process|file is in use|permission denied|access is denied)[^'"\n\r]*['"]([^'"]+)['"]/i,
+  /((?:\.git[\\/])?[^\s"'`]+\.lock)\b/i,
+];
+
+function normalizeText(value: string | null | undefined): string {
+  return (value ?? "").replace(/\r\n/g, "\n").replace(/\r/g, "\n").trim();
+}
+
+function isDeleteCommand(command: string): boolean {
+  return DELETE_COMMAND_PATTERN.test(command);
+}
+
+function findCause(text: string): string | null {
+  for (const { pattern, label } of BLOCKED_DELETE_CAUSE_PATTERNS) {
+    if (pattern.test(text)) return label;
+  }
+  return null;
+}
+
+function findBlockedPath(text: string): string | null {
+  for (const pattern of PATH_PATTERNS) {
+    const match = pattern.exec(text);
+    const path = match?.[1]?.trim();
+    if (path) return path.replace(/[.,;:]+$/g, "");
+  }
+  return null;
+}
+
+export function getBlockedCleanupFailure(activity: RunToolActivity): string | null {
+  if (activity.status !== "failed") return null;
+
+  const command = normalizeText(activity.command);
+  const summary = normalizeText(activity.summary);
+  const combined = [command, summary].filter(Boolean).join("\n");
+  if (!command || !isDeleteCommand(command)) return null;
+
+  const cause = findCause(combined);
+  if (!cause) return null;
+
+  const blockedPath = findBlockedPath(combined);
+  const target = blockedPath ? `\nBlocked item: ${blockedPath}` : "";
+  return [
+    "Cleanup stopped because a safe generated artifact could not be deleted.",
+    `Cause: ${cause}.`,
+    target,
+    "Codexa stopped after the first clear blocked-delete signal to avoid retrying a doomed cleanup.",
+  ].filter(Boolean).join("\n");
+}

package/src/core/clipboard.ts

@@ -0,0 +1,24 @@
+import { spawn } from "child_process";
+import { platform } from "os";
+
+function trySpawn(cmd: string, args: string[], text: string): Promise<boolean> {
+  return new Promise((resolve) => {
+    const proc = spawn(cmd, args, { stdio: ["pipe", "ignore", "ignore"] });
+    proc.on("error", () => resolve(false));
+    proc.on("close", (code) => resolve(code === 0));
+    proc.stdin?.write(text);
+    proc.stdin?.end();
+  });
+}
+
+export async function copyToClipboard(text: string): Promise<boolean> {
+  const os = platform();
+
+  if (os === "win32") return trySpawn("clip", [], text);
+  if (os === "darwin") return trySpawn("pbcopy", [], text);
+
+  // Linux: try xclip, fall back to xsel
+  const ok = await trySpawn("xclip", ["-selection", "clipboard"], text);
+  if (ok) return true;
+  return trySpawn("xsel", ["--clipboard", "--input"], text);
+}

package/src/core/codex.ts

@@ -0,0 +1,124 @@
+import { spawn } from "child_process";
+import type { ResolvedRuntimeConfig } from "../config/runtimeConfig.js";
+import { formatCodexLaunchError, spawnCodexProcess } from "./executables/codexExecutable.js";
+import { prepareCodexExecLaunch } from "./codexLaunch.js";
+import { createTerminalTitleSequenceStripper } from "./terminal/terminalTitle.js";
+
+export interface CodexHandlers {
+  onLine: (line: string) => void;
+  onDone: () => void;
+  onError: (message: string) => void;
+}
+
+export function streamCodex(
+  prompt: string,
+  runtime: ResolvedRuntimeConfig,
+  workspaceRoot: string,
+  handlers: CodexHandlers,
+): () => void {
+  let done = false;
+  let cancelled = false;
+  let proc: ReturnType<typeof spawn> | null = null;
+
+  const finishError = (message: string) => {
+    if (done) return;
+    done = true;
+    handlers.onError(message);
+  };
+  const finishSuccess = () => {
+    if (done) return;
+    done = true;
+    handlers.onDone();
+  };
+
+  void prepareCodexExecLaunch(
+    {
+      runtime,
+      cwd: workspaceRoot,
+      structuredOutput: false,
+    },
+    import.meta.url,
+  )
+    .then((launchPlan) => {
+      if (cancelled) return;
+      if (!launchPlan.ok) {
+        finishError(launchPlan.error);
+        return;
+      }
+      if (!launchPlan.executable) {
+        finishError("Codex launch preparation did not return an executable.");
+        return;
+      }
+
+      proc = spawnCodexProcess(
+        launchPlan.executable,
+        launchPlan.args,
+        { stdio: ["pipe", "pipe", "pipe"] },
+      );
+
+      proc.stdin?.write(prompt);
+      proc.stdin?.end();
+
+      let buffer = "";
+
+      // Strip title escape sequences from child output — prevents the subprocess from overwriting the terminal title.
+      const stdoutTitleStripper = createTerminalTitleSequenceStripper({
+        source: "src/core/codex.ts:codex.stdout",
+        stream: "stdout",
+        origin: "codex-cli",
+      });
+      const stderrTitleStripper = createTerminalTitleSequenceStripper({
+        source: "src/core/codex.ts:codex.stderr",
+        stream: "stderr",
+        origin: "codex-cli",
+      });
+
+      const flushLine = (line: string) => {
+        if (cancelled || done) return;
+        if (line.trim()) handlers.onLine(line);
+      };
+
+      const handleText = (text: string) => {
+        if (!text) return;
+        if (cancelled || done) return;
+        buffer += text;
+        const lines = buffer.split("\n");
+        buffer = lines.pop() ?? "";
+        lines.forEach(flushLine);
+      };
+
+      proc.stdout?.on("data", (chunk: Buffer) => handleText(stdoutTitleStripper.process(chunk)));
+      proc.stderr?.on("data", (chunk: Buffer) => handleText(stderrTitleStripper.process(chunk)));
+
+      proc.on("close", (code) => {
+        if (cancelled || done) return;
+        handleText(stdoutTitleStripper.flush());
+        handleText(stderrTitleStripper.flush());
+        if (buffer.trim()) flushLine(buffer);
+        buffer = "";
+        if (done) return;
+        if (code === 0) {
+          finishSuccess();
+        } else {
+          finishError(`Process exited with code ${code}`);
+        }
+      });
+
+      proc.on("error", (err) => {
+        if (cancelled || done) return;
+        const errno = err as NodeJS.ErrnoException;
+        const msg = formatCodexLaunchError(errno);
+        finishError(msg);
+      });
+    })
+    .catch((error) => {
+      const errno = error as NodeJS.ErrnoException;
+      finishError(formatCodexLaunchError(errno));
+    });
+
+  return () => {
+    cancelled = true;
+    done = true;
+    proc?.kill();
+  };
+}

package/src/core/codexExecArgs.test.ts

@@ -0,0 +1,195 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { resolveRuntimeConfig, normalizeRuntimeConfig } from "../config/runtimeConfig.js";
+import { buildCodexExecArgs } from "./codexExecArgs.js";
+import type { CodexCliCapabilities } from "./models/codexCapabilities.js";
+
+const fullCapabilities: CodexCliCapabilities = {
+  askForApproval: true,
+  sandbox: true,
+  config: true,
+  fullAuto: true,
+};
+
+test("uses dedicated runtime policy flags when supported", () => {
+  const result = buildCodexExecArgs({
+    runtime: resolveRuntimeConfig(normalizeRuntimeConfig({
+      model: "gpt-5.4",
+      policy: {
+        approvalPolicy: "untrusted",
+        sandboxMode: "read-only",
+      },
+    })),
+    cwd: "C:/repo",
+  }, fullCapabilities);
+
+  assert.deepEqual(result, {
+    ok: true,
+    strategy: "direct-flags",
+    args: [
+      "exec",
+      "--experimental-json",
+      "--skip-git-repo-check",
+      "--cd",
+      "C:/repo",
+      "--model",
+      "gpt-5.4",
+      "--config",
+      "model_reasoning_effort=high",
+      "--ask-for-approval",
+      "untrusted",
+      "--sandbox",
+      "read-only",
+      "-",
+    ],
+  });
+});
+
+test("falls back to config overrides when dedicated policy flags are unavailable", () => {
+  const result = buildCodexExecArgs({
+    runtime: resolveRuntimeConfig(normalizeRuntimeConfig({
+      model: "gpt-5.4-mini",
+      reasoningLevel: "medium",
+      policy: {
+        approvalPolicy: "on-request",
+        sandboxMode: "workspace-write",
+      },
+    })),
+    cwd: "C:/repo",
+  }, {
+    askForApproval: false,
+    sandbox: false,
+    config: true,
+    fullAuto: false,
+  });
+
+  assert.deepEqual(result, {
+    ok: true,
+    strategy: "config-overrides",
+    args: [
+      "exec",
+      "--experimental-json",
+      "--skip-git-repo-check",
+      "--cd",
+      "C:/repo",
+      "--model",
+      "gpt-5.4-mini",
+      "--config",
+      "model_reasoning_effort=medium",
+      "-c",
+      "approval_policy=on-request",
+      "-c",
+      "sandbox_mode=workspace-write",
+      "-",
+    ],
+  });
+});
+
+test("fails clearly when the requested policy cannot be represented safely", () => {
+  const result = buildCodexExecArgs({
+    runtime: resolveRuntimeConfig(normalizeRuntimeConfig({
+      model: "gpt-5.4",
+      policy: {
+        approvalPolicy: "on-request",
+        sandboxMode: "workspace-write",
+      },
+    })),
+    cwd: "C:/repo",
+  }, {
+    askForApproval: false,
+    sandbox: false,
+    config: false,
+    fullAuto: false,
+  });
+
+  assert.equal(result.ok, false);
+  assert.equal(result.strategy, "fail");
+  assert.match(result.ok ? "" : result.error, /cannot safely apply the selected reasoning level/i);
+  assert.match(result.ok ? "" : result.error, /does not support --config/i);
+});
+
+test("uses mixed config and direct flags when only approval direct flag is unavailable", () => {
+  const result = buildCodexExecArgs({
+    runtime: resolveRuntimeConfig(normalizeRuntimeConfig({
+      model: "gpt-5.4",
+      reasoningLevel: "medium",
+      policy: {
+        approvalPolicy: "on-request",
+        sandboxMode: "workspace-write",
+      },
+    })),
+    cwd: "C:/repo",
+  }, {
+    askForApproval: false,
+    sandbox: true,
+    config: true,
+    fullAuto: true,
+  });
+
+  assert.deepEqual(result, {
+    ok: true,
+    strategy: "config-overrides",
+    args: [
+      "exec",
+      "--experimental-json",
+      "--skip-git-repo-check",
+      "--cd",
+      "C:/repo",
+      "--model",
+      "gpt-5.4",
+      "--config",
+      "model_reasoning_effort=medium",
+      "-c",
+      "approval_policy=on-request",
+      "--sandbox",
+      "workspace-write",
+      "-",
+    ],
+  });
+});
+
+test("forwards network, writable roots, service tier, and personality as config overrides", () => {
+  const result = buildCodexExecArgs({
+    runtime: resolveRuntimeConfig(normalizeRuntimeConfig({
+      model: "gpt-5.4",
+      policy: {
+        approvalPolicy: "never",
+        sandboxMode: "workspace-write",
+        networkAccess: "enabled",
+        writableRoots: ["C:/repo/tmp", "C:/repo/cache"],
+        serviceTier: "fast",
+        personality: "pragmatic",
+      },
+    })),
+    cwd: "C:/repo",
+  }, fullCapabilities);
+
+  assert.deepEqual(result, {
+    ok: true,
+    strategy: "direct-flags",
+    args: [
+      "exec",
+      "--experimental-json",
+      "--skip-git-repo-check",
+      "--cd",
+      "C:/repo",
+      "--model",
+      "gpt-5.4",
+      "--config",
+      "model_reasoning_effort=high",
+      "--ask-for-approval",
+      "never",
+      "--sandbox",
+      "workspace-write",
+      "--config",
+      "sandbox_workspace_write.network_access=true",
+      "--config",
+      "sandbox_workspace_write.writable_roots=[\"C:\\\\repo\\\\tmp\",\"C:\\\\repo\\\\cache\"]",
+      "--config",
+      "service_tier=fast",
+      "--config",
+      "personality=pragmatic",
+      "-",
+    ],
+  });
+});

package/src/core/codexExecArgs.ts

@@ -0,0 +1,152 @@
+import type { ResolvedRuntimeConfig } from "../config/runtimeConfig.js";
+import type { CodexCliCapabilities } from "./models/codexCapabilities.js";
+
+export interface BuildCodexExecArgsOptions {
+  runtime: ResolvedRuntimeConfig;
+  cwd: string;
+  structuredOutput?: boolean;
+}
+
+export type CodexLaunchStrategy =
+  | "direct-flags"
+  | "config-overrides"
+  | "full-auto"
+  | "fail";
+
+export type BuildCodexExecArgsResult =
+  | { ok: true; args: string[]; strategy: Exclude<CodexLaunchStrategy, "fail"> }
+  | { ok: false; error: string; strategy: "fail" };
+
+// Prevents newline/null injection into CLI args — rejects the path if it contains unsafe characters.
+function sanitizeWorkingDirectory(cwd: string): string {
+  if (cwd.includes("\n") || cwd.includes("\r") || cwd.includes("\0")) {
+    return process.cwd();
+  }
+
+  return cwd;
+}
+
+function isFullAutoRuntime(runtime: ResolvedRuntimeConfig): boolean {
+  return runtime.policy.approvalPolicy === "never" && runtime.policy.sandboxMode === "danger-full-access";
+}
+
+function buildCapabilitySummary(capabilities: CodexCliCapabilities): string {
+  const supported: string[] = [];
+
+  if (capabilities.askForApproval) supported.push("--ask-for-approval");
+  if (capabilities.sandbox) supported.push("--sandbox");
+  if (capabilities.config) supported.push("--config/-c");
+  if (capabilities.fullAuto) supported.push("--full-auto");
+
+  return supported.length > 0 ? supported.join(", ") : "none";
+}
+
+function buildRuntimeFailureMessage(runtime: ResolvedRuntimeConfig, capabilities: CodexCliCapabilities): string {
+  return [
+    "Installed Codex CLI cannot safely apply the requested runtime configuration.",
+    `Requested approval policy: ${runtime.policy.approvalPolicy}.`,
+    `Requested sandbox mode: ${runtime.policy.sandboxMode}.`,
+    `Detected launch controls: ${buildCapabilitySummary(capabilities)}.`,
+    "Update Codex or choose a runtime configuration that your installed CLI can represent.",
+  ].join("\n");
+}
+
+function buildRuntimePolicyArgs(runtime: ResolvedRuntimeConfig, capabilities: CodexCliCapabilities): BuildCodexExecArgsResult {
+  const args: string[] = [];
+  const missingDirectApproval = !capabilities.askForApproval;
+  const missingDirectSandbox = !capabilities.sandbox;
+  const runtimePolicy = runtime.policy;
+
+  if (!missingDirectApproval && !missingDirectSandbox) {
+    args.push("--ask-for-approval", runtimePolicy.approvalPolicy);
+    args.push("--sandbox", runtimePolicy.sandboxMode);
+    return { ok: true, args, strategy: "direct-flags" };
+  }
+
+  if (isFullAutoRuntime(runtime) && capabilities.fullAuto) {
+    args.push("--full-auto");
+    return { ok: true, args, strategy: "full-auto" };
+  }
+
+  if (capabilities.config) {
+    if (capabilities.askForApproval) {
+      args.push("--ask-for-approval", runtimePolicy.approvalPolicy);
+    } else {
+      args.push("-c", `approval_policy=${runtimePolicy.approvalPolicy}`);
+    }
+
+    if (capabilities.sandbox) {
+      args.push("--sandbox", runtimePolicy.sandboxMode);
+    } else {
+      args.push("-c", `sandbox_mode=${runtimePolicy.sandboxMode}`);
+    }
+
+    return { ok: true, args, strategy: "config-overrides" };
+  }
+
+  return {
+    ok: false,
+    strategy: "fail",
+    error: buildRuntimeFailureMessage(runtime, capabilities),
+  };
+}
+
+export function buildCodexExecArgs(
+  options: BuildCodexExecArgsOptions,
+  capabilities: CodexCliCapabilities,
+): BuildCodexExecArgsResult {
+  const { runtime } = options;
+  const args: string[] = ["exec"];
+
+  if (options.structuredOutput ?? true) {
+    args.push("--experimental-json");
+  }
+
+  args.push(
+    "--skip-git-repo-check",
+    "--cd",
+    sanitizeWorkingDirectory(options.cwd),
+    "--model",
+    runtime.model,
+  );
+
+  if (!capabilities.config) {
+    return {
+      ok: false,
+      strategy: "fail",
+      error: [
+        `Installed Codex CLI cannot safely apply the selected reasoning level "${runtime.reasoningLevel}".`,
+        `Detected launch controls: ${buildCapabilitySummary(capabilities)}.`,
+        "This Codex version does not support --config / -c overrides.",
+      ].join("\n"),
+    };
+  }
+
+  args.push("--config", `model_reasoning_effort=${runtime.reasoningLevel}`);
+
+  const policyArgs = buildRuntimePolicyArgs(runtime, capabilities);
+  if (!policyArgs.ok) {
+    return policyArgs;
+  }
+
+  args.push(...policyArgs.args);
+
+  if (runtime.policy.networkAccess) {
+    args.push("--config", `sandbox_workspace_write.network_access=${JSON.stringify(runtime.policy.networkAccess)}`);
+  }
+
+  if (runtime.policy.writableRoots.length > 0) {
+    args.push("--config", `sandbox_workspace_write.writable_roots=${JSON.stringify(runtime.policy.writableRoots)}`);
+  }
+
+  if (runtime.policy.serviceTier !== "flex") {
+    args.push("--config", `service_tier=${runtime.policy.serviceTier}`);
+  }
+
+  if (runtime.policy.personality !== "none") {
+    args.push("--config", `personality=${runtime.policy.personality}`);
+  }
+
+  args.push("-");
+  return { ok: true, args, strategy: policyArgs.strategy };
+}