@jini-ai/daemon 0.6.12 → 0.6.15-rc.1

package/CHANGELOG.md

@@ -1,3 +1,37 @@
+## 0.6.13
+
+### Patch Changes
+
+- aef0152: Folder-limited Claude runs get a private per-run CLAUDE_CODE_TMPDIR (a 0700 /tmp/jini-\* directory, removed on exit, crash, cancellation or startup failure). The sandbox grants only that run's scratch subtree; the shared per-user /tmp/claude-<uid> grant is gone, and overlong bases are refused instead of falling back to shared scratch.
+- e9f64d4: PROTOTYPE (cloud/observability-1025, not for release): `withToolCallObservability` (`@jini-ai/daemon/tool-recovery`) makes each tool call one `tool.call` operation on a structural observability slice; execution errors are reported, validation errors are counted only.
+- a0ce70f: Add opt-in host-managed SQLite event-log schema setup, a borrowed-kernel factory that joins host transactions (its replay reads one statement snapshot, so it also works on read-only kernels and inside a host run()), and append receipts for conflicting retries or retention-cap refusals. Existing append defaults and FIFO retention remain unchanged.
+- 0728914: Engine guard clean-up (`pnpm guard` 106 -> 0): layer, subpath-isolation and module-state findings fixed by moving
+  shared contracts to their owners instead of reaching across domains. Additive public API: `@jini-ai/core/filesystem`
+  (guarded-reader contracts), `useFetchQueryScope` from `@jini-ai/ui` fetch-query (per-provider query scope),
+  `@jini-ai/chat/react` re-exports of the accepted-input, run-state and agent-plugin chat-state helpers. The Claude
+  filesystem probe cache in `@jini-ai/agent-runtime` is instance-owned. No behaviour change intended; host-facing
+  breaks are listed in `owner-store-to-server` and `guard-host-ports`.
+- cbce255: Apply AI-trace capture policy to errors, contain tracing and sink failures, preserve canonical
+  usage and stop reasons, accumulate request usage snapshots, scope tool identities per request,
+  and finalize traces from committed terminal events including inactivity watchdog completion.
+  Provider/session trace mappers now receive object arguments.
+  A trace whose stream subscription is refused or rejects after `run_started` is now finished from
+  the run's real terminal state (`waitForTerminal`, in the background) instead of being dropped.
+  `RunLifecycle.waitForTerminal` takes an optional `{ signal }`: aborting it rejects with the reason and
+  unregisters the waiter. The traced lifecycle gains `dispose()`, which releases open traces without
+  finishing them and cancels those background waits; the server kernel's `close()` calls it after the
+  agent runtime stops, so a retained kernel keeps no recorder or waiter.
+- 803a949: Observability vendor adapters as provider subpaths: `@jini-ai/diagnostics/observability/opentelemetry` (moved from Tovu core) and `@jini-ai/diagnostics/observability/sentry`, each returning `{ port, dispose }` with optional peer SDKs. Review fixes: attribute strings and `Error.name` redacted and capped; fan-out isolates each adapter's tracker creation and end; Sentry root operations start fresh traces and never call `NodeClient#init()` or channel injection. `withToolCallObservability` exports a fixed label for unregistered tool ids and adds `user.id` (pseudonymous principal).
+- b1fcb8f: AI tracing no longer reopens a trace when `dispose()` runs while the underlying start is pending; `waitForTerminal()` observes its abort signal while a durable start append is still pending; the fenced-outbox conformance overlap case reports a synchronously throwing `awaitOverlap` hook as a barrier failure (contender settled, nothing unhandled) and `awaitOverlap` is documented.
+- Updated dependencies [7479159]
+- Updated dependencies [c31264d]
+- Updated dependencies [0728914]
+- Updated dependencies [cbce255]
+- Updated dependencies [6ecbdb2]
+- Updated dependencies [63bacc5]
+  - @jini-ai/core@0.6.13
+  - @jini-ai/protocol@0.6.13
+
 ## 0.6.12
 
 ### Patch Changes

package/dist/agent-executor/codex/home-config.d.ts

@@ -0,0 +1,50 @@
+import type { McpJsonServerEntry } from '../contracts.js';
+/** A TOML key: bare when TOML allows it, quoted otherwise — host-supplied bridge env names are not guaranteed bare-safe. */
+export declare function tomlKey(key: string): string;
+/**
+ * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
+ * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
+ * Codex's own config schema expects.
+ *
+ * Confirmed against a real installed Codex CLI (0.151.0), not assumed from docs: round-tripping
+ * `codex mcp add <name> --env K=V -- <cmd> <args>` against a scratch `CODEX_HOME` and reading back
+ * `config.toml` produced exactly this shape (`command`/`args` as TOML strings/array in the main
+ * table, env vars in a nested `.env` table) — see `archived provenance ledger` for the transcript.
+ * @param entry - The shared bridge entry from {@link buildMcpJsonServerEntry}.
+ * @returns A TOML fragment with no leading/trailing blank-line padding — {@link buildCodexHomeConfigToml} owns spacing when combining it with existing content.
+ * @complexity O(n) in the number of argv/env entries.
+ * @overallScore 100/100
+ */
+export declare function buildCodexMcpServerToml({ entry }: {
+    readonly entry: McpJsonServerEntry;
+}): string;
+/**
+ * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
+ * config, with any pre-existing `[mcp_servers.jini]` table removed (see
+ * {@link stripExistingJiniMcpServerTable}), then this run's own table appended.
+ *
+ * **Append-only by design, not a parse-and-merge, for everything but the jini table itself.**
+ * `mergeMcpJsonContent`/`mergeEnvContentMcpConfig` in `mcp-bridge.ts` can safely parse-merge-reserialize because
+ * their formats have a JS-native parser (`JSON.parse`); re-serializing parsed TOML would drop
+ * comments and layout (see `buildCodexMcpServerToml`'s doc), and every other setting a real Codex
+ * install carries — model choice, sandbox policy, the trusted-project list, the operator's own
+ * other MCP servers — must survive a spawn byte-for-byte. Only the one table this driver itself
+ * owns (`jini` is this integration's own reserved server name — see {@link JINI_MCP_SERVER_KEY}) is
+ * removed by default, via the narrow line-oriented scan above, never a full TOML parse. Explicit
+ * per-run OFF choices additionally omit personal MCP tables or retain only those tables when
+ * user settings are off. Inline root MCP declarations fail closed when isolation is requested,
+ * and `isolation.ts` parses the result to refuse any server or trust entry this line scan could not see.
+ * @param existingRaw - The real Codex home's `config.toml` content, or `undefined` when it does not
+ * exist (a fresh Codex install — degrades to "start from just this run's block", matching
+ * {@link mergeMcpJsonContent}'s own "missing file" handling).
+ * @param entry - The shared bridge entry.
+ * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
+ * @complexity O(n) in the existing config's length.
+ */
+export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings }: {
+    readonly existingRaw: string | undefined;
+    readonly entry: McpJsonServerEntry;
+    readonly inheritUserMcp?: boolean;
+    readonly inheritUserSettings?: boolean;
+}, _optional?: Record<string, never>): string;
+//# sourceMappingURL=home-config.d.ts.map

package/dist/agent-executor/codex/home-config.js

@@ -0,0 +1,209 @@
+import { JINI_MCP_SERVER_KEY } from '../mcp-bridge.js';
+/**
+ * TOML basic-string escaping for the narrow value shapes {@link buildCodexMcpServerToml} emits (a
+ * command name, an argv token, an env var value — never multi-line or control-character-heavy
+ * text). Escapes exactly what TOML's basic-string grammar requires: backslash first (so it is not
+ * re-escaped by a later replacement), then the quote delimiter, then the three whitespace control
+ * characters a real command/argv/env value could plausibly contain.
+ *
+ * A hand-rolled minimal escaper rather than a TOML serializer — this mechanism never needs to
+ * *re-serialize* TOML (the real install's existing `config.toml` is appended after, never
+ * rewritten — see {@link buildCodexHomeConfigToml}), so a full TOML writer for one serialization
+ * shape would be substantially more surface than the problem needs. The isolation check
+ * (`isolation.ts`) parses layers with smol-toml, but only reads them.
+ * @param value - The raw string to embed inside TOML `"..."` delimiters.
+ * @returns The escaped text, WITHOUT the surrounding quotes — {@link tomlString} adds those.
+ * @complexity O(n) in the string's length.
+ */
+function escapeTomlBasicString(value) {
+    return value
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+        .replace(/\t/g, '\\t');
+}
+/** Wraps {@link escapeTomlBasicString}'s output in the TOML basic-string delimiters. */
+function tomlString(value) {
+    return `"${escapeTomlBasicString(value)}"`;
+}
+/** A TOML key: bare when TOML allows it, quoted otherwise — host-supplied bridge env names are not guaranteed bare-safe. */
+export function tomlKey(key) {
+    return /^[A-Za-z0-9_-]+$/.test(key) ? key : tomlString(key);
+}
+/**
+ * Codex's per-tool deadline for the Jini bridge, in seconds: `@jini-ai/mcp`'s
+ * `DEFAULT_DELEGATED_TOOL_TIMEOUT_MS` (6 min, mirrored because this package does not depend on
+ * that one) plus 40 s. Codex's own default (60 s) is shorter than a delegated call parked on a
+ * human dialog, and when Codex abandons a call the dialog stayed answerable, so a late click ran
+ * an action the model had been told failed. Outlasting the bridge's deadline means the bridge
+ * times out first, drops its daemon request, and the daemon expires the dialog. Codex does not
+ * pass the parent env through to MCP servers, so the bridge under Codex always runs at its default.
+ */
+const CODEX_TOOL_TIMEOUT_SEC = 6 * 60 + 40;
+/**
+ * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
+ * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
+ * Codex's own config schema expects.
+ *
+ * Confirmed against a real installed Codex CLI (0.151.0), not assumed from docs: round-tripping
+ * `codex mcp add <name> --env K=V -- <cmd> <args>` against a scratch `CODEX_HOME` and reading back
+ * `config.toml` produced exactly this shape (`command`/`args` as TOML strings/array in the main
+ * table, env vars in a nested `.env` table) — see `archived provenance ledger` for the transcript.
+ * @param entry - The shared bridge entry from {@link buildMcpJsonServerEntry}.
+ * @returns A TOML fragment with no leading/trailing blank-line padding — {@link buildCodexHomeConfigToml} owns spacing when combining it with existing content.
+ * @complexity O(n) in the number of argv/env entries.
+ * @overallScore 100/100
+ */
+export function buildCodexMcpServerToml({ entry }) {
+    const argsLiteral = entry.args.map(tomlString).join(', ');
+    const serverTable = `[mcp_servers.${JINI_MCP_SERVER_KEY}]\ncommand = ${tomlString(entry.command)}\nargs = [${argsLiteral}]\n` +
+        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n`;
+    const envLines = Object.entries(entry.env)
+        .filter((pair) => typeof pair[1] === 'string')
+        .map(([key, value]) => `${tomlKey(key)} = ${tomlString(value)}`);
+    if (envLines.length === 0)
+        return serverTable;
+    return `${serverTable}\n[mcp_servers.${JINI_MCP_SERVER_KEY}.env]\n${envLines.join('\n')}\n`;
+}
+/**
+ * Splits a TOML table header's dotted key into its individual segments, honoring quoted parts
+ * (`"basic"` or `'literal'`) that may themselves contain a literal `.` — a bare `.` only
+ * separates segments outside of quotes. Each segment is trimmed and, if quoted, unwrapped.
+ *
+ * Not a full TOML parser: it does not resolve escape sequences (`\"`, `\u...`) inside basic
+ * strings. That is deliberately out of scope — see {@link stripExistingJiniMcpServerTable}'s doc
+ * for why it is safe to skip for this specific comparison.
+ * @param rawKey - The raw text between a table header's `[` and `]`.
+ * @returns The dotted key's segments, dequoted and trimmed.
+ * @complexity O(n) in the length of `rawKey`.
+ */
+function splitTomlDottedKey(rawKey) {
+    const scan = { segments: [], current: '', quote: null };
+    for (const ch of rawKey) {
+        if (scan.quote === null)
+            scanBareTomlKeyChar(scan, ch);
+        else if (ch === scan.quote)
+            scan.quote = null;
+        else
+            scan.current += ch;
+    }
+    scan.segments.push(scan.current.trim());
+    return scan.segments;
+}
+/** One key character outside quotes: opens a quote, ends the open segment at a `.`, or extends it. */
+function scanBareTomlKeyChar(scan, ch) {
+    if (ch === '"' || ch === "'")
+        scan.quote = ch;
+    else if (ch === '.') {
+        scan.segments.push(scan.current.trim());
+        scan.current = '';
+    }
+    else
+        scan.current += ch;
+}
+// An inline or dotted root `mcp_servers` declaration, which the table scanner below cannot rewrite.
+const INLINE_MCP_SERVERS = /^\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*(?:\.|=)/;
+// `[<key>]` optionally followed only by a `# comment`; `[[...]]` never matches (see below).
+const TOML_TABLE_HEADER = /^\s*\[([^[\]]+)\]\s*(#.*)?$/;
+/**
+ * Whether {@link stripExistingJiniMcpServerTable} drops the table named `key`: always the jini
+ * table and its subtables; with `allServers` every MCP table and every `projects` (trust) table,
+ * so Codex loads no project layer that could add a server; with `mcpOnly` every non-MCP table.
+ */
+function dropsTomlTable(key, optional) {
+    const jiniTableKey = `mcp_servers.${JINI_MCP_SERVER_KEY}`;
+    if (key === jiniTableKey || key.startsWith(`${jiniTableKey}.`))
+        return true;
+    const isMcp = key === 'mcp_servers' || key.startsWith('mcp_servers.');
+    if (optional.allServers === true && (isMcp || key === 'projects' || key.startsWith('projects.')))
+        return true;
+    return optional.mcpOnly === true && !isMcp;
+}
+/**
+ * Removes any pre-existing `[mcp_servers.{@link JINI_MCP_SERVER_KEY}]` table — and its
+ * `[mcp_servers.{@link JINI_MCP_SERVER_KEY}.*]` subtables (e.g. `.env`) — from a real Codex
+ * `config.toml`'s raw text, so {@link buildCodexHomeConfigToml} can append this run's own table
+ * without producing the duplicate TOML key Codex's parser rejects at startup.
+ *
+ * Line-oriented, not a real TOML parser (matching {@link buildCodexMcpServerToml}'s own
+ * no-TOML-dependency constraint), but wide enough to survive a hand-edited config, which is the
+ * scenario this whole function exists for. A table header line is recognized when, after
+ * trimming, it is `[<key>]` optionally followed only by a `# comment` (TOML's own grammar allows
+ * nothing else there) — so it tolerates leading indentation, whitespace inside the brackets, a
+ * trailing line comment, and a dotted key written with quoted segments (`["mcp_servers"."jini"]`),
+ * via {@link splitTomlDottedKey}. Once such a header's key matches the jini table or one of its
+ * subtables, every following line is dropped until the next table header (of any name) or EOF.
+ * Every other table, key, comment-only, and blank line is passed through untouched.
+ *
+ * Deliberately unhandled, and why it is safe to leave that way:
+ * - **Escape sequences inside quoted key segments** (e.g. a segment containing `\"`) — neither
+ *   `mcp_servers` nor {@link JINI_MCP_SERVER_KEY} ever needs escaping, and this driver's own
+ *   writer ({@link buildCodexMcpServerToml}) never emits a quoted form at all, so no real
+ *   `config.toml` this driver produced can exercise this gap; a hand-edit that goes out of its
+ *   way to escape a character inside a key that is supposed to spell "jini" would fail to match
+ *   and fall back to today's pre-fix behavior (append a duplicate) rather than silently doing
+ *   something worse.
+ * - **`[[array-of-tables]]` syntax** — Codex's schema has no array-of-tables shape for
+ *   `mcp_servers`, and the header regex's `[^[\]]+` capture cannot match a line starting with a
+ *   second `[`, so `[[mcp_servers.jini]]` is not recognized as a header before or after this fix
+ *   — unchanged, not a new gap.
+ * - **A single quoted segment that happens to spell the same characters with the dot included**
+ *   (e.g. `["mcp_servers.jini"]`, which in real TOML names one key literally containing a `.`,
+ *   not two nested tables) — this collapses to the same joined string as the real nested-table
+ *   spelling and is therefore treated as a match. This is a false positive in the conservative
+ *   direction the reported bug calls for: a missed detection duplicates a key and crashes Codex,
+ *   so on this axis over-matching a spelling nobody would plausibly hand-write for an MCP server
+ *   table is preferable to under-matching the real one.
+ * @param existingRaw - The real Codex home's `config.toml` content, already known to be defined
+ * (callers pass `''` for a missing file).
+ * @returns `existingRaw` with any jini table/subtable removed.
+ * @complexity O(n) in the number of lines.
+ */
+function stripExistingJiniMcpServerTable(existingRaw, optional = {}) {
+    const kept = [];
+    let skipping = optional.mcpOnly === true;
+    for (const line of existingRaw.split('\n')) {
+        // The existing table scanner cannot safely rewrite inline/dotted root server values. Refuse
+        // that uncommon shape when isolating servers rather than accidentally preserving a grant.
+        if (optional.allServers && INLINE_MCP_SERVERS.test(line)) {
+            throw new Error('Cannot turn off personal MCP servers: the Codex config.toml declares mcp_servers inline (a dotted key or `mcp_servers = {...}`), which cannot be removed safely; move each server into its own [mcp_servers.<name>] table.');
+        }
+        const header = TOML_TABLE_HEADER.exec(line);
+        // The header's key capture group is not optional, so `header[1]` is always set on a match.
+        if (header)
+            skipping = dropsTomlTable(splitTomlDottedKey(header[1]).join('.'), optional);
+        if (!skipping)
+            kept.push(line);
+    }
+    return kept.join('\n');
+}
+/**
+ * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
+ * config, with any pre-existing `[mcp_servers.jini]` table removed (see
+ * {@link stripExistingJiniMcpServerTable}), then this run's own table appended.
+ *
+ * **Append-only by design, not a parse-and-merge, for everything but the jini table itself.**
+ * `mergeMcpJsonContent`/`mergeEnvContentMcpConfig` in `mcp-bridge.ts` can safely parse-merge-reserialize because
+ * their formats have a JS-native parser (`JSON.parse`); re-serializing parsed TOML would drop
+ * comments and layout (see `buildCodexMcpServerToml`'s doc), and every other setting a real Codex
+ * install carries — model choice, sandbox policy, the trusted-project list, the operator's own
+ * other MCP servers — must survive a spawn byte-for-byte. Only the one table this driver itself
+ * owns (`jini` is this integration's own reserved server name — see {@link JINI_MCP_SERVER_KEY}) is
+ * removed by default, via the narrow line-oriented scan above, never a full TOML parse. Explicit
+ * per-run OFF choices additionally omit personal MCP tables or retain only those tables when
+ * user settings are off. Inline root MCP declarations fail closed when isolation is requested,
+ * and `isolation.ts` parses the result to refuse any server or trust entry this line scan could not see.
+ * @param existingRaw - The real Codex home's `config.toml` content, or `undefined` when it does not
+ * exist (a fresh Codex install — degrades to "start from just this run's block", matching
+ * {@link mergeMcpJsonContent}'s own "missing file" handling).
+ * @param entry - The shared bridge entry.
+ * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
+ * @complexity O(n) in the existing config's length.
+ */
+export function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp = true, inheritUserSettings = true }, _optional = {}) {
+    const base = stripExistingJiniMcpServerTable(existingRaw ?? '', { allServers: !inheritUserMcp, mcpOnly: !inheritUserSettings });
+    const separator = base.length === 0 ? '' : base.endsWith('\n') ? '\n' : '\n\n';
+    return `${base}${separator}${buildCodexMcpServerToml({ entry: entry })}`;
+}
+//# sourceMappingURL=home-config.js.map

package/dist/agent-executor/codex/home-staging.d.ts

@@ -0,0 +1,60 @@
+import type { RuntimeAgentDef } from '@jini-ai/agent-runtime';
+import type { McpJsonInjectionOptions, McpBridgeDelivery, PreparedCodexHome, FailBeforeSpawn } from '../contracts.js';
+/**
+ * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
+ * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
+ * `process.env` at the real call site), not a run's sandboxed spawn env: `CODEX_HOME` is not in
+ * `BASELINE_AGENT_ENV_KEYS`, so a spawned child never inherits it anyway, and the whole point here
+ * is finding wherever the *operator's actual* Codex install lives, which is a host-machine fact.
+ * @param hostEnv - The daemon process's own environment.
+ * @returns `hostEnv.CODEX_HOME` when set to a non-blank value (matching Codex's own resolution
+ * order), else the CLI's documented default, `~/.codex`.
+ * @complexity O(1).
+ * @overallScore 100/100
+ */
+export declare function resolveSourceCodexHomeDir({ hostEnv }: {
+    readonly hostEnv: NodeJS.ProcessEnv;
+}): string;
+/**
+ * The child env pointed at a staged `CODEX_HOME`. Drops `CODEX_INTERNAL_ORIGINATOR_OVERRIDE`: a
+ * first-party originator lets a mentioned skill install and start MCP servers (codex-rs
+ * `mcp_skill_dependencies.rs`), and `codex exec` is `codex_exec` without it.
+ */
+export declare function withStagedCodexHome({ env, codexHomeDir }: {
+    readonly env: NodeJS.ProcessEnv;
+    readonly codexHomeDir: string;
+}, _options?: {}): NodeJS.ProcessEnv;
+/** Which personal Codex config a staged home keeps: none when native tools are locked, else what the run's capabilities allow. */
+export declare function codexInheritance(input: {
+    readonly nativeToolAccess?: boolean | undefined;
+    readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
+}): {
+    settings: boolean;
+    mcp: boolean;
+};
+/**
+ * Phase 10b: mechanism 5 of 5's one effect — stages this run's scratch `CODEX_HOME` directory,
+ * returning the prepared handle `cleanupStagedFiles` should later release (`null` for every other
+ * mechanism, or for an unconfigured host — matching {@link writeMcpJsonIfNeeded}'s identical gate).
+ * @param input.def - Only used for its `id`, in the failure message.
+ * @param input.mcpBridge - This run's resolved bridge delivery — a no-op unless its `kind` is `'codex-toml'`.
+ * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceCodexHomeDir} rather than read from a module-level `process.env` so this phase stays testable with an injected env.
+ * @complexity O(1) plus {@link prepareCodexHomeForRun}'s own cost.
+ * @overallScore 100/100
+ */
+export declare function prepareCodexHomeIfNeeded({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly nativeToolAccess?: boolean | undefined;
+        readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
+        readonly def: RuntimeAgentDef;
+        readonly mcpBridge: McpBridgeDelivery | null;
+    };
+    readonly deps: {
+        readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
+        readonly hostEnv: NodeJS.ProcessEnv;
+        readonly releaseStagedResources: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
+}): Promise<PreparedCodexHome | null>;
+//# sourceMappingURL=home-staging.d.ts.map

package/dist/agent-executor/codex/home-staging.js

@@ -0,0 +1,195 @@
+import { promises as fsPromises } from 'node:fs';
+import { homedir, tmpdir, } from 'node:os';
+import { join, resolve, } from 'node:path';
+import { errorMessage } from '../values.js';
+import { defaultReadMcpJsonFile, defaultWriteMcpJsonFile } from '../mcp-bridge.js';
+import { buildCodexHomeConfigToml } from './home-config.js';
+import { assertCodexHomeConfigParses, assertStagedHomeIsolated, CodexMcpIsolationError, codexIsolationRefusalMessage } from './isolation.js';
+/**
+ * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
+ * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
+ * `process.env` at the real call site), not a run's sandboxed spawn env: `CODEX_HOME` is not in
+ * `BASELINE_AGENT_ENV_KEYS`, so a spawned child never inherits it anyway, and the whole point here
+ * is finding wherever the *operator's actual* Codex install lives, which is a host-machine fact.
+ * @param hostEnv - The daemon process's own environment.
+ * @returns `hostEnv.CODEX_HOME` when set to a non-blank value (matching Codex's own resolution
+ * order), else the CLI's documented default, `~/.codex`.
+ * @complexity O(1).
+ * @overallScore 100/100
+ */
+export function resolveSourceCodexHomeDir({ hostEnv }) {
+    const override = hostEnv.CODEX_HOME;
+    return override !== undefined && override.trim().length > 0 ? override : join(homedir(), '.codex');
+}
+/**
+ * The child env pointed at a staged `CODEX_HOME`. Drops `CODEX_INTERNAL_ORIGINATOR_OVERRIDE`: a
+ * first-party originator lets a mentioned skill install and start MCP servers (codex-rs
+ * `mcp_skill_dependencies.rs`), and `codex exec` is `codex_exec` without it.
+ */
+export function withStagedCodexHome({ env, codexHomeDir }, _options = {}) {
+    const { CODEX_INTERNAL_ORIGINATOR_OVERRIDE: _originator, ...rest } = env;
+    return { ...rest, CODEX_HOME: codexHomeDir };
+}
+function defaultMkdtempCodexHome({ prefix }) {
+    return fsPromises.mkdtemp(join(tmpdir(), prefix));
+}
+function defaultRemoveCodexHomeDir({ path }) {
+    return fsPromises.rm(path, { recursive: true, force: true });
+}
+/** Config credentials stay run-scoped, but rollouts must survive both completion and cancellation.
+ * Native links keep Codex as the sole writer of sessions and refreshed authentication.
+ * Parity also links skills/rules/plugins and other home entries; config.toml alone stays staged
+ * so run-scoped bearer tokens never reach the real config. Cleanup removes links, not targets.
+ * O(h) I/O for h top-level home entries; locked runs link only sessions and authentication. */
+async function defaultLinkCodexSessionStore({ runHome, sourceHome }, optional = {}) {
+    for (const name of ['sessions', 'archived_sessions']) {
+        const target = resolve(sourceHome, name);
+        await fsPromises.mkdir(target, { recursive: true, mode: 0o700 });
+        await fsPromises.symlink(target, join(runHome, name), 'junction');
+    }
+    await fsPromises.symlink(join(sourceHome, 'auth.json'), join(runHome, 'auth.json'), 'file');
+    if (optional.inheritUserConfig !== false) {
+        for (const entry of await fsPromises.readdir(sourceHome, { withFileTypes: true })) {
+            if (['config.toml', 'auth.json', 'sessions', 'archived_sessions'].includes(entry.name))
+                continue;
+            await fsPromises.symlink(join(sourceHome, entry.name), join(runHome, entry.name), entry.isDirectory() ? 'junction' : 'file');
+        }
+    }
+}
+function resolveCodexHomeSeams(options) {
+    return {
+        mkdtemp: options.mkdtemp ?? defaultMkdtempCodexHome,
+        readFile: options.readFile ?? defaultReadMcpJsonFile,
+        writeFile: options.writeFile ?? defaultWriteMcpJsonFile,
+        removeDir: options.removeDir ?? defaultRemoveCodexHomeDir,
+        linkSessionStore: options.linkSessionStore ?? defaultLinkCodexSessionStore,
+    };
+}
+/**
+ * The staged `config.toml`. With personal MCP off the real home config must parse before its line
+ * rewrite is trusted, and the staged home must declare only the bridge and trust no project (so
+ * Codex's trust gate keeps project `.codex/config.toml` layers out unless another layer trusts
+ * them). Plugin, app and skill-installed servers are turned off on the CLI layer (`defs/codex.ts`).
+ * Layers outside the home (system, MDM, cloud bundle) are the machine owner's policy, which Off
+ * doesn't override (design note 2026-10-27, option N). The spawn-time refusal in
+ * {@link prepareCodexHomeIfNeeded} stays the backstop for every blocked case.
+ * @throws {@link CodexMcpIsolationError} when the run can't be isolated.
+ */
+function buildStagedCodexConfig({ existingRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome }) {
+    const build = () => buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings: inheritUserConfig });
+    if (inheritUserMcp)
+        return build();
+    const path = join(sourceHome, 'config.toml');
+    assertCodexHomeConfigParses({ raw: existingRaw, path });
+    const homeConfig = build();
+    assertStagedHomeIsolated({ homeConfig, path });
+    return homeConfig;
+}
+/**
+ * Mechanism 5 of 5 — `'codex-toml'`'s one effect. Stages a fresh, randomly-named `CODEX_HOME`
+ * directory (see {@link McpJsonInjectionOptions.mkdtemp}'s doc for why non-deterministic naming is
+ * load-bearing here, not cosmetic) carrying:
+ *   - `config.toml`: the real Codex home's own config (read best-effort — see
+ *     {@link buildCodexHomeConfigToml}'s "missing file" handling) with this run's
+ *     `[mcp_servers.jini]` table appended.
+ *   - `auth.json`: a link to the real Codex home's stored login, so the spawned CLI is
+ *     still authenticated. Best-effort is safe here, not merely convenient: a real headless spawn
+ *     against a `CODEX_HOME` with no `auth.json` at all was confirmed (against installed Codex CLI
+ *     0.151.0) to fail fast with a structured `401 Unauthorized` stream event, never an interactive
+ *     login prompt or a hang — see `defs/codex.ts`'s module doc for the full transcript summary.
+ *
+ * Never changes the real config. Authentication is linked so a CLI token refresh survives cleanup;
+ * copying rotating credentials lost refreshes and could log the operator out. Deleting scratch
+ * state must not erase linked native state. The run-bound MCP credential stays in scratch config.
+ *
+ * A failure after the directory is created (a rejecting `writeFile`, most plausibly) does not leak
+ * it: the directory may already hold a partial `config.toml` or a copied credential, so the
+ * `catch` below best-effort-removes it before rethrowing, exactly the "partial-failure state leak"
+ * class of bug this package's own adversarial-test-design guidance calls out.
+ * @param runId - Embedded in the temp-dir prefix for traceability, sanitized the same way
+ * `@jini-ai/agent-runtime`'s `prepareAgentLogFile`'s `label` is.
+ * @param entry - The shared bridge entry.
+ * @param sourceCodexHomeDir - Where to read the real install's `config.toml`/`auth.json` from — see {@link resolveSourceCodexHomeDir}.
+ * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir/linkSessionStore, real filesystem by default.
+ * @throws Whatever staging rejects with — the caller ({@link prepareCodexHomeIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link writeMcpJsonForRun}'s own contract.
+ * @complexity O(h) filesystem operations for h top-level user-home entries; one staged config write.
+ * @overallScore 100/100
+ */
+async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams, inheritUserConfig = true, inheritUserMcp = true) {
+    // Stricter than `@jini-ai/agent-runtime`'s `prepareAgentLogFile`/`preparePromptFileForAgent`
+    // labels (which keep dots): this prefix stages a directory that ends up holding a copied Codex
+    // login credential, so it gets `mcpJsonPathForRun`'s tighter discipline instead — dots stripped
+    // too, not just path separators, so a run id like `../../etc/evil` cannot leave even a cosmetic
+    // `..` substring in the mkdtemp prefix.
+    const safeRunId = runId.replace(/[^A-Za-z0-9_-]/g, '-').slice(0, 80) || 'run';
+    const dir = await seams.mkdtemp({ prefix: `jini-codex-home-${safeRunId}-` });
+    try {
+        let existingConfigRaw;
+        try {
+            existingConfigRaw = inheritUserConfig || inheritUserMcp ? await seams.readFile({ path: join(sourceCodexHomeDir, 'config.toml') }) : undefined;
+        }
+        catch {
+            // No config yet (fresh Codex install) or unreadable — start from just this run's block,
+            // matching writeMcpJsonForRun's identical "missing file" handling.
+            existingConfigRaw = undefined;
+        }
+        const content = buildStagedCodexConfig({ existingRaw: existingConfigRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome: sourceCodexHomeDir });
+        await seams.writeFile({ path: join(dir, 'config.toml'), content });
+        await seams.linkSessionStore({ runHome: dir, sourceHome: sourceCodexHomeDir }, { inheritUserConfig });
+    }
+    catch (err) {
+        await seams.removeDir({ path: dir }).catch(() => {
+            // Best-effort only — the original error below is what the caller must see either way.
+        });
+        throw err;
+    }
+    return {
+        path: dir,
+        cleanup: async () => {
+            await seams.removeDir({ path: dir });
+        },
+    };
+}
+/** True when a Codex run turns off the operator's personal MCP servers or settings, which only a staged home can do. */
+function codexTurnsOffPersonalConfig(input) {
+    const capabilities = input.nativeCapabilities;
+    return input.def.id === 'codex' && (capabilities?.userMcp === false || capabilities?.userSettings === false);
+}
+/** Which personal Codex config a staged home keeps: none when native tools are locked, else what the run's capabilities allow. */
+export function codexInheritance(input) {
+    const nativeAllowed = input.nativeToolAccess !== false;
+    return { settings: nativeAllowed && input.nativeCapabilities?.userSettings !== false, mcp: nativeAllowed && input.nativeCapabilities?.userMcp !== false };
+}
+/**
+ * Phase 10b: mechanism 5 of 5's one effect — stages this run's scratch `CODEX_HOME` directory,
+ * returning the prepared handle `cleanupStagedFiles` should later release (`null` for every other
+ * mechanism, or for an unconfigured host — matching {@link writeMcpJsonIfNeeded}'s identical gate).
+ * @param input.def - Only used for its `id`, in the failure message.
+ * @param input.mcpBridge - This run's resolved bridge delivery — a no-op unless its `kind` is `'codex-toml'`.
+ * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceCodexHomeDir} rather than read from a module-level `process.env` so this phase stays testable with an injected env.
+ * @complexity O(1) plus {@link prepareCodexHomeForRun}'s own cost.
+ * @overallScore 100/100
+ */
+export async function prepareCodexHomeIfNeeded({ input, deps }) {
+    if (input.mcpBridge?.kind !== 'codex-toml' || deps.mcpJsonInjection === undefined) {
+        if (codexTurnsOffPersonalConfig(input)) {
+            await deps.releaseStagedResources();
+            return deps.failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED',
+                message: 'AgentExecutor: disabling personal Codex configuration requires run-scoped home staging.' });
+        }
+        return null;
+    }
+    const inherit = codexInheritance(input);
+    try {
+        return await prepareCodexHomeForRun(input.runId, input.mcpBridge.serverEntry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp);
+    }
+    catch (err) {
+        await deps.releaseStagedResources();
+        if (err instanceof CodexMcpIsolationError) {
+            return deps.failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED',
+                message: codexIsolationRefusalMessage(err.message) });
+        }
+        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not stage a CODEX_HOME for agent "${input.def.id}": ${errorMessage(err)}` });
+    }
+}
+//# sourceMappingURL=home-staging.js.map

package/dist/agent-executor/codex/isolation.d.ts

@@ -0,0 +1,27 @@
+/** A run with personal MCP off that Codex cannot keep to the bridge alone: refused, never run with a leak. */
+export declare class CodexMcpIsolationError extends Error {
+}
+/** The user-facing refusal for a {@link CodexMcpIsolationError} reason. */
+export declare function codexIsolationRefusalMessage(reason: string): string;
+/**
+ * The real home config must parse before its line-based rewrite ({@link buildCodexHomeConfigToml})
+ * is trusted: a malformed block the rewrite drops would otherwise hide that the line scan misread
+ * the file. A missing file (`undefined`) is fine.
+ * @throws {@link CodexMcpIsolationError} when it isn't valid TOML.
+ */
+export declare function assertCodexHomeConfigParses({ raw, path }: {
+    readonly raw: string | undefined;
+    readonly path: string;
+}): void;
+/**
+ * The staged home config, parsed: it must declare no MCP server but the bridge and trust no
+ * project. The home rewrite ({@link buildCodexHomeConfigToml}) is line-based so every other byte
+ * survives, so a server or trust entry it cannot see (an escaped header, a dotted root key) or a
+ * multi-line value a fake header split is refused here instead of staged. O(n) in the config length.
+ * @throws {@link CodexMcpIsolationError} when the staged config would not isolate the run.
+ */
+export declare function assertStagedHomeIsolated({ homeConfig, path }: {
+    readonly homeConfig: string;
+    readonly path: string;
+}): void;
+//# sourceMappingURL=isolation.d.ts.map

package/dist/agent-executor/codex/isolation.js

@@ -0,0 +1,67 @@
+import { parse } from 'smol-toml';
+import { JINI_MCP_SERVER_KEY } from '../mcp-bridge.js';
+import { isRecord } from '../values.js';
+/** A run with personal MCP off that Codex cannot keep to the bridge alone: refused, never run with a leak. */
+export class CodexMcpIsolationError extends Error {
+}
+/** The user-facing refusal for a {@link CodexMcpIsolationError} reason. */
+export function codexIsolationRefusalMessage(reason) {
+    return `Codex can't run with 'Your MCP servers' off: ${reason} Turn it on in the assistant settings, or choose Claude.`;
+}
+/**
+ * Parses one Codex config layer with a real TOML parser, so no spelling (quoted or escaped keys,
+ * dotted keys, inline tables, or a `[header]`-shaped line inside a multi-line string or array)
+ * hides a server from the check. A file that does not parse is refused: what it declares can't be
+ * known, and Codex could not load it either.
+ * @complexity O(n) in the file length.
+ */
+function parseCodexLayer(raw, path) {
+    try {
+        return parse(raw);
+    }
+    catch {
+        throw new CodexMcpIsolationError(`${path} isn't valid TOML, so its MCP servers can't be checked.`);
+    }
+}
+/**
+ * Refuses a layer that trusts a project. Codex loads a project's `.codex/config.toml` only when the
+ * config merged below it trusts that project (codex-rs `config/src/loader/mod.rs` L:1098-1125), so
+ * with no `projects` table anywhere no project layer, worktree root or root-marker range can add a
+ * server. Parsed, so a dotted, inline or escaped spelling is caught too.
+ */
+function assertTrustsNoProject(config, path) {
+    if ('projects' in config)
+        throw new CodexMcpIsolationError(`${path} trusts projects in a way that can't be removed safely.`);
+}
+/**
+ * The real home config must parse before its line-based rewrite ({@link buildCodexHomeConfigToml})
+ * is trusted: a malformed block the rewrite drops would otherwise hide that the line scan misread
+ * the file. A missing file (`undefined`) is fine.
+ * @throws {@link CodexMcpIsolationError} when it isn't valid TOML.
+ */
+export function assertCodexHomeConfigParses({ raw, path }) {
+    if (raw !== undefined)
+        parseCodexLayer(raw, path);
+}
+/**
+ * The staged home config, parsed: it must declare no MCP server but the bridge and trust no
+ * project. The home rewrite ({@link buildCodexHomeConfigToml}) is line-based so every other byte
+ * survives, so a server or trust entry it cannot see (an escaped header, a dotted root key) or a
+ * multi-line value a fake header split is refused here instead of staged. O(n) in the config length.
+ * @throws {@link CodexMcpIsolationError} when the staged config would not isolate the run.
+ */
+export function assertStagedHomeIsolated({ homeConfig, path }) {
+    const refusal = new CodexMcpIsolationError(`${path} declares MCP servers that can't be removed safely.`);
+    let config;
+    try {
+        config = parse(homeConfig);
+    }
+    catch {
+        throw refusal;
+    }
+    const ids = isRecord(config.mcp_servers) ? Object.keys(config.mcp_servers) : [];
+    if (ids.some(id => id !== JINI_MCP_SERVER_KEY))
+        throw refusal;
+    assertTrustsNoProject(config, path);
+}
+//# sourceMappingURL=isolation.js.map