@gotcos/glasses-server 6.18.4 → 6.18.5

package/.env.example

@@ -53,9 +53,13 @@ BIND_HOST=0.0.0.0
 # COS_CODEX_MODEL=
 # COS_CODEX_REASONING_EFFORT=high   # low | medium | high | xhigh | max | ultra
 #
-# Codex remains read-only by default. This is the only broader trust opt-in:
+# Codex remains read-only by default. Broader trust opt-in (workdir writes +
+# outbound network inside that sandbox — needed for Gmail API / HTTPS):
 # COS_CODEX_SANDBOX=workspace-write
-#
+# Pair with ~/.codex/config.toml [sandbox_workspace_write] network_access = true
+# for interactive Codex CLI; the managed glasses server also passes
+# -c sandbox_workspace_write.network_access=true when workspace-write is set.
+
 # Claude preserves COS's established trusted-machine behavior by default.
 # Security-conscious installs can remove the permission bypass and restrict
 # Claude to COS's explicit per-query tool allowlist. Undeclared tools fail

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 6.18.5
+
+- **Codex workspace-write now includes outbound network.** `workspace-write`
+  alone still blocked HTTPS (Gmail API, etc.) because Codex defaults
+  `sandbox_workspace_write.network_access` to off. When
+  `COS_CODEX_SANDBOX=workspace-write`, the managed server now passes
+  `-c sandbox_workspace_write.network_access=true` and the capability header
+  states HTTPS is available. Pair with the same key in `~/.codex/config.toml`
+  for interactive Codex CLI. Still not `danger-full-access` — writes stay
+  inside the workdir. Prefer COS `email_cache` / `email_gmail_api` over
+  approval-gated Google Workspace connector sends from glasses.
+
 ## 6.18.4
 
 - **Meeting sync progress on `/api/health`.** Post-meeting HQ polish writes

package/README.md

@@ -70,7 +70,10 @@ without silently losing completed replies.
 > omit the execution mode default to Ask.
 > Existing `COS_CODEX_MODEL` / `COS_CODEX_REASONING_EFFORT` settings remain
 > supported on the migrated Frontier slot; leave them blank for auto-latest.
-> Codex runs **sandboxed read-only** by default (`COS_CODEX_SANDBOX` to adjust).
+> Codex runs **sandboxed read-only** by default. Set
+> `COS_CODEX_SANDBOX=workspace-write` for workdir writes + outbound network
+> (`sandbox_workspace_write.network_access=true` is passed by the managed server
+> and should also be set in `~/.codex/config.toml` for interactive Codex).
 > **Claude is the most permissive provider by default.** It runs with
 > `--dangerously-skip-permissions`, so a glasses query on the Claude/Opus path can
 > run shell commands and read, edit, and write files on this Mac without prompting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.18.4",
+  "version": "6.18.5",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/codex-bridge.ts

@@ -83,14 +83,24 @@ const PHASE_LABELS: Record<Phase, string> = {
 // Sandbox policy for `codex exec`. This public server NEVER runs codex
 // unsandboxed — that would let a remote glasses query execute arbitrary commands
 // on the host. Default: read-only (safe for chat). COS_CODEX_SANDBOX=workspace-write
-// permits writes within the working directory only. Full host access is
+// permits writes within the working directory only, and enables outbound network
+// inside that sandbox (Gmail API, HTTPS fetches) via
+// `sandbox_workspace_write.network_access=true`. Full host filesystem access is
 // intentionally not exposed by this server.
 function codexSandboxMode(): 'workspace-write' | 'read-only' {
   return process.env.COS_CODEX_SANDBOX === 'workspace-write' ? 'workspace-write' : 'read-only'
 }
 
 function codexSandboxArgs(): string[] {
-  return ['--sandbox', codexSandboxMode(), '--skip-git-repo-check']
+  const args = ['--sandbox', codexSandboxMode(), '--skip-git-repo-check']
+  // workspace-write keeps the filesystem boundary but leaves network OFF by
+  // default in Codex. Glasses outbound Gmail (and similar HTTPS) needs this
+  // explicit opt-in — without it agents correctly report "cannot reach
+  // gmail.googleapis.com" even when workspace writes work.
+  if (codexSandboxMode() === 'workspace-write') {
+    args.push('-c', 'sandbox_workspace_write.network_access=true')
+  }
+  return args
 }
 
 /**
@@ -101,7 +111,7 @@ function codexSandboxArgs(): string[] {
 function codexCapabilityPrompt(): string {
   if (codexSandboxMode() === 'workspace-write') {
     return `TOOL CAPABILITY CONTRACT:
-You are an AGENT model running \`codex exec --sandbox workspace-write\`. Reads, searches, shell commands, and writes inside the working directory are available to you whether or not any list names them. Never claim a tool is unavailable based on that list or on any header — PROBE first with one real call; only an attempted call that actually failed is evidence a capability is missing. Writes outside the working directory are denied by the sandbox; say that plainly if you hit it.
+You are an AGENT model running \`codex exec --sandbox workspace-write\` with \`sandbox_workspace_write.network_access=true\`. Reads, searches, shell commands, outbound HTTPS (including Gmail API / cos_python network calls), and writes inside the working directory are available to you whether or not any list names them. Never claim a tool is unavailable based on that list or on any header — PROBE first with one real call; only an attempted call that actually failed is evidence a capability is missing. Writes outside the working directory are denied by the sandbox; say that plainly if you hit it. Prefer the COS Gmail API script path (\`email_cache\` / \`email_gmail_api\` with confirm=True) over approval-gated Google Workspace connector sends.
 ${TOOL_HONESTY_CLAUSE}
 ${UNTRUSTED_CONTENT_CLAUSE}`
   }