@inixiative/agent-session 0.3.0 → 0.3.1

package/README.md

@@ -96,6 +96,11 @@ const result = await decisions.decide(
 );
 ```
 
+Run Codex decisions on a private `CODEX_HOME` that holds only the login (link
+`auth.json` from the account's home; a copy forks its refresh token): Codex has no
+setting that drops the user's own `AGENTS.md`, and a decision thread that reports
+any instruction source is refused.
+
 Codex hosts every key as a thread of one `app-server` process per account and
 forks the primed thread per cycle; Claude forks a persisted primed session with
 a pre-spawned spare. Measured on a ChatGPT login: warm Codex decisions 2.45 s

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/agent-session",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Drive coding-agent CLIs as persistent, streaming, event-captured sessions over interchangeable transports, with primed decision sessions, subscription pools, routing, limit polling and continuity.",
   "type": "module",
   "main": "src/index.ts",
@@ -36,7 +36,7 @@
   "license": "MIT",
   "devDependencies": {
     "@biomejs/biome": "2.5.2",
-    "@inixiative/config": "^0.5.40",
+    "@inixiative/config": "^0.5.41",
     "@types/bun": "1.4.2",
     "lefthook": "2.1.9",
     "typescript": "6.0.3"

package/src/codex-primed.ts

@@ -75,15 +75,19 @@ export const CODEX_DECISION_DISABLED_FEATURES: readonly string[] = [
 ];
 
 /**
- * Per-thread configuration for decisions: no notify hook, no built-in MCP server,
- * no project docs or skills, and none of the instruction surfaces that describe
- * tools or the environment. Applied on thread/start and thread/fork (verified
- * equivalent to launch-level `-c` overrides), so the launch argv carries only
- * approval, web-search and feature flags that credential launchers accept.
+ * Per-thread configuration for decisions: no notify hook, no project docs or skills,
+ * and none of the instruction surfaces that describe tools or the environment.
+ * Applied on thread/start and thread/fork (verified equivalent to launch-level `-c`
+ * overrides), so the launch argv carries only approval, web-search and feature flags
+ * that credential launchers accept.
+ *
+ * The user's own CODEX_HOME (its AGENTS.md, memories, MCP servers) is not a thread
+ * setting: run decisions on a private CODEX_HOME holding only the login. A thread
+ * that reports an instruction source is refused, and an MCP server that starts is a
+ * violation.
  */
 export const CODEX_DECISION_THREAD_CONFIG: Readonly<Record<string, unknown>> = Object.freeze({
   notify: [],
-  'mcp_servers.node_repl.enabled': false,
   project_doc_max_bytes: 0,
   'skills.enabled': false,
   include_permissions_instructions: false,
@@ -213,6 +217,19 @@ interface Branch {
   wake(): void;
 }
 
+/** Instruction files Codex loaded into a thread (the user's AGENTS.md, project docs); a decision allows none. */
+const instructionSources = (response: Record<string, unknown> | undefined): string | undefined => {
+  const sources = response?.instructionSources;
+  return Array.isArray(sources) && sources.length ? sources.map(String).join(', ') : undefined;
+};
+const instructionLeak = (sources: string) =>
+  new DecisionError(
+    `Codex loaded instructions into a decision thread (${sources}); run decisions on a private CODEX_HOME`,
+    'violation',
+    'not-dispatched',
+    true,
+  );
+
 const object = (value: unknown): Record<string, unknown> | undefined =>
   value !== null && typeof value === 'object' && !Array.isArray(value)
     ? (value as Record<string, unknown>)
@@ -1045,6 +1062,11 @@ export class CodexPrimedSessions implements PrimedSessions {
         'not-dispatched',
         true,
       );
+    const leaked = instructionSources(started);
+    if (leaked) {
+      void conn.request('thread/delete', { threadId: baseId }, 10_000).catch(() => undefined);
+      throw instructionLeak(leaked);
+    }
     const branch = this._branch(conn, baseId, spec.key);
     let ok = false;
     try {
@@ -1287,6 +1309,8 @@ export class CodexPrimedSessions implements PrimedSessions {
       );
       const id = object(response?.thread)?.id;
       if (typeof id !== 'string' || !id) throw Error('Codex returned no decision thread');
+      const leaked = instructionSources(response);
+      if (leaked) throw instructionLeak(leaked);
       model ??= typeof response?.model === 'string' ? response.model : undefined;
       return { threadId: id, branch: this._branch(conn, id, spec.key) };
     };
@@ -1294,6 +1318,7 @@ export class CodexPrimedSessions implements PrimedSessions {
       if (Date.now() >= deadline || signal?.aborted) throw expired();
       const t1 = performance.now();
       const opened = await openBranch().catch((error) => {
+        if (error instanceof DecisionError) throw error;
         // The runtime refusing the fork means the primed thread is gone: retire it and prime again off-path.
         // A timeout proves nothing about the primed thread.
         if (session && error instanceof JsonRpcError) this._retire(session, 'reprime');