@jigging/jig 0.1.0-alpha.2 → 0.1.0-alpha.6

package/libexec/agent/codex-agent-launcher.js

@@ -0,0 +1,54 @@
+// @bun
+// src/internal/codex-agent-launcher.ts
+import { closeSync, mkdirSync, openSync, readSync, writeSync } from "fs";
+var STARTUP_INPUT_BYTES = 64 * 1024;
+var CODEX_HOME = "/tmp/codex-home";
+var CREDENTIAL_PATH = `${CODEX_HOME}/auth.json`;
+var ADAPTER_SPECIFIER = "./codex-acp.js";
+if (import.meta.main)
+  await main();
+async function main() {
+  mkdirSync(CODEX_HOME, { mode: 448 });
+  const startup = process.env.JIG_CODEX_STARTUP_INPUT;
+  if (startup !== undefined && startup !== "subscription") {
+    throw new Error("Codex startup input mode is invalid");
+  }
+  if (startup === "subscription")
+    materializeCredential();
+  delete process.env.JIG_CODEX_STARTUP_INPUT;
+  await import(ADAPTER_SPECIFIER);
+}
+function materializeCredential() {
+  const header = readExactly(4);
+  const size = new DataView(header.buffer, header.byteOffset, header.byteLength).getUint32(0, false);
+  if (size === 0 || size > STARTUP_INPUT_BYTES - 4) {
+    throw new Error("Codex startup input is invalid");
+  }
+  const credential = readExactly(size);
+  let descriptor;
+  try {
+    descriptor = openSync(CREDENTIAL_PATH, "wx", 384);
+    writeExactly(descriptor, credential);
+  } finally {
+    credential.fill(0);
+    if (descriptor !== undefined)
+      closeSync(descriptor);
+  }
+}
+function readExactly(size) {
+  const result = new Uint8Array(size);
+  let offset = 0;
+  while (offset < result.byteLength) {
+    const count = readSync(0, result, offset, result.byteLength - offset, null);
+    if (count === 0)
+      throw new Error("Codex startup input ended early");
+    offset += count;
+  }
+  return result;
+}
+function writeExactly(descriptor, value) {
+  let offset = 0;
+  while (offset < value.byteLength) {
+    offset += writeSync(descriptor, value, offset, value.byteLength - offset, null);
+  }
+}

package/libexec/agent/codex-requirements.toml

@@ -0,0 +1,5 @@
+allowed_approval_policies = ["on-request"]
+allowed_sandbox_modes = ["read-only", "workspace-write"]
+
+[permissions.filesystem]
+deny_read = ["/tmp/codex-home/auth.json"]