@hua-labs/tap 0.4.2 → 0.5.1

package/dist/bridges/codex-bridge-runner.d.mts

@@ -8,5 +8,6 @@ interface BridgeScriptArgsOptions {
 }
 declare function resolveBridgeDaemonScript(repoRoot: string, runnerUrl?: string, fileExists?: (candidate: string) => boolean): string | null;
 declare function buildBridgeScriptArgs(scriptPath: string, options: BridgeScriptArgsOptions): string[];
+declare function buildBridgeDaemonEnv(parentEnv: NodeJS.ProcessEnv, runtimeEnv: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 
-export { buildBridgeScriptArgs, resolveBridgeDaemonScript };
+export { buildBridgeDaemonEnv, buildBridgeScriptArgs, resolveBridgeDaemonScript };

package/dist/bridges/codex-bridge-runner.mjs

@@ -1142,6 +1142,12 @@ function buildBridgeScriptArgs(scriptPath, options) {
   }
   return args;
 }
+function buildBridgeDaemonEnv(parentEnv, runtimeEnv) {
+  return {
+    ...parentEnv,
+    ...runtimeEnv
+  };
+}
 async function main() {
   const repoRootHint = findRepoRootFromRunner() ?? void 0;
   const { config } = resolveConfig({}, repoRootHint);
@@ -1156,8 +1162,22 @@ async function main() {
     Number.isFinite(instancePort) ? instancePort : void 0
   );
   const instanceId = process.env.TAP_BRIDGE_INSTANCE_ID;
-  const envStateDir = process.env.TAP_STATE_DIR;
-  const stateDir = envStateDir ? envStateDir : instanceId ? path7.join(repoRoot, ".tmp", `codex-app-server-bridge-${instanceId}`) : void 0;
+  const envStateDir = process.env.TAP_RUNTIME_STATE_DIR;
+  let stateDir;
+  if (envStateDir) {
+    stateDir = envStateDir;
+  } else if (instanceId) {
+    const resolved2 = path7.resolve(
+      path7.join(repoRoot, ".tmp", `codex-app-server-bridge-${instanceId}`)
+    );
+    const expectedBase = path7.resolve(repoRoot, ".tmp") + path7.sep;
+    if (!resolved2.startsWith(expectedBase)) {
+      throw new Error(
+        `Path traversal blocked: runtime state dir escapes .tmp/ directory`
+      );
+    }
+    stateDir = resolved2;
+  }
   const preResolved = process.env.TAP_RESOLVED_NODE;
   const resolved = preResolved ? {
     command: preResolved,
@@ -1203,9 +1223,10 @@ Expected a packaged dist/bridges/codex-app-server-bridge.mjs or monorepo bridge
   if (process.env.TAP_PROCESS_EXISTING === "true")
     args.push("--process-existing-messages");
   const runtimeEnv = buildRuntimeEnv(repoRoot);
+  const daemonEnv = buildBridgeDaemonEnv(process.env, runtimeEnv);
   const child = spawn(command, args, {
     cwd: repoRoot,
-    env: runtimeEnv,
+    env: daemonEnv,
     stdio: "inherit"
   });
   maybeStartHeadlessLoop(repoRoot, commsDir, stateDir);
@@ -1233,6 +1254,7 @@ if (isDirectExecution()) {
   });
 }
 export {
+  buildBridgeDaemonEnv,
   buildBridgeScriptArgs,
   resolveBridgeDaemonScript
 };