@lesscap/baton-cli 0.4.3 → 0.5.1

package/dist/baton.mjs

@@ -4777,30 +4777,30 @@ import { join } from "node:path";
 var PROJECT_CONFIG_NAME = ".baton.json";
 var projectConfigPath = (cwd = process.cwd()) => join(cwd, PROJECT_CONFIG_NAME);
 var configPathFromArgs = (args, cwd) => args.config ?? projectConfigPath(cwd);
-var loadProjectConfig = (path3) => {
+var loadProjectConfig = (path) => {
   try {
-    return JSON.parse(readFileSync(path3, "utf8"));
+    return JSON.parse(readFileSync(path, "utf8"));
   } catch (err) {
-    const cause = err.code === "ENOENT" ? `not found at ${path3}` : String(err);
+    const cause = err.code === "ENOENT" ? `not found at ${path}` : String(err);
     throw new Error(`${PROJECT_CONFIG_NAME} ${cause} \u2014 run \`baton init\` first`);
   }
 };
-var loadProjectConfigOrNull = (path3) => {
-  if (!existsSync(path3)) return null;
+var loadProjectConfigOrNull = (path) => {
+  if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync(path3, "utf8"));
+    return JSON.parse(readFileSync(path, "utf8"));
   } catch {
     return null;
   }
 };
-var saveProjectConfig = (path3, config) => {
-  writeFileSync(path3, `${JSON.stringify(config, null, 2)}
+var saveProjectConfig = (path, config) => {
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 };
-var patch = (path3, fn) => {
-  saveProjectConfig(path3, fn(loadProjectConfig(path3)));
+var patch = (path, fn) => {
+  saveProjectConfig(path, fn(loadProjectConfig(path)));
 };
-var setWorker = (path3, w) => patch(path3, (cfg) => ({ ...cfg, worker: w }));
+var setWorker = (path, w) => patch(path, (cfg) => ({ ...cfg, worker: w }));
 var requireBase = (cfg) => {
   if (!cfg.server || !cfg.project || !cfg.worker)
     throw new Error("project-config missing server/project/worker \u2014 run `baton worker register`");
@@ -5566,7 +5566,7 @@ var BY_EXT = {
   ".json": "application/json",
   ".csv": "text/csv"
 };
-var contentTypeForPath = (path3) => BY_EXT[extname(path3).toLowerCase()] ?? "application/octet-stream";
+var contentTypeForPath = (path) => BY_EXT[extname(path).toLowerCase()] ?? "application/octet-stream";
 
 // src/commands/attach.ts
 import { openAsBlob } from "node:fs";
@@ -5574,12 +5574,12 @@ import { basename } from "node:path";
 var attachPaths = (raw) => (raw === void 0 ? [] : Array.isArray(raw) ? raw : [raw]).flatMap((p) => p.split(",")).map((p) => p.trim()).filter(Boolean);
 var uploadAttachments = async (client, sessionId, paths) => {
   const out = [];
-  for (const path3 of paths) {
-    const body = await openAsBlob(path3, { type: contentTypeForPath(path3) });
+  for (const path of paths) {
+    const body = await openAsBlob(path, { type: contentTypeForPath(path) });
     out.push(
       await client.sessions.uploadAttachment(sessionId, {
-        filename: basename(path3),
-        contentType: contentTypeForPath(path3),
+        filename: basename(path),
+        contentType: contentTypeForPath(path),
         body
       })
     );
@@ -5612,12 +5612,12 @@ var sendCommand = defineCommand({
     if (text === void 0 && args.file) text = readFileSync2(args.file, "utf8");
     if (text === void 0 && !process.stdin.isTTY) text = await readStdin();
     const attachments = [];
-    for (const path3 of attachPaths(args.attach)) {
+    for (const path of attachPaths(args.attach)) {
       attachments.push(
         await client.uploadAttachment(args.channel, {
-          filename: basename2(path3),
-          contentType: contentTypeForPath(path3),
-          body: await openAsBlob2(path3, { type: contentTypeForPath(path3) })
+          filename: basename2(path),
+          contentType: contentTypeForPath(path),
+          body: await openAsBlob2(path, { type: contentTypeForPath(path) })
         })
       );
     }
@@ -6411,6 +6411,26 @@ var additionalDirs = () => {
   const dirs = raw.split(":").map((s) => s.trim()).filter((s) => s !== "" && isAbsolute(s) && existsSync3(s));
   return dirs.length > 0 ? dirs : void 0;
 };
+var truthy = (value) => {
+  if (value === void 0) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) return true;
+  if (["0", "false", "no", "off"].includes(normalized)) return false;
+  return void 0;
+};
+var codexNetworkAccess = () => truthy(process.env.BATON_CODEX_NETWORK_ACCESS);
+var codexSandboxMode = (planMode) => {
+  if (planMode) return "read-only";
+  const raw = process.env.BATON_CODEX_SANDBOX_MODE;
+  if (raw === "read-only" || raw === "workspace-write" || raw === "danger-full-access") return raw;
+  return "workspace-write";
+};
+var codexApprovalPolicy = () => {
+  const raw = process.env.BATON_CODEX_APPROVAL_POLICY;
+  if (raw === "never" || raw === "on-request" || raw === "on-failure" || raw === "untrusted")
+    return raw;
+  return "never";
+};
 
 // src/session/runner/transcript.ts
 import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
@@ -6463,10 +6483,10 @@ var parseFirstExchange = (content) => {
   return userText || assistantText ? { userText, assistantText } : null;
 };
 var readFirstExchange = (agentSessionId) => {
-  const path3 = findTranscriptPath(agentSessionId);
-  if (!path3) return null;
+  const path = findTranscriptPath(agentSessionId);
+  if (!path) return null;
   try {
-    return parseFirstExchange(readFileSync4(path3, "utf8"));
+    return parseFirstExchange(readFileSync4(path, "utf8"));
   } catch {
     return null;
   }
@@ -6523,534 +6543,8 @@ var augmentPrompt = (text, relPaths, labels) => {
 ${text}` : header;
 };
 
-// ../../node_modules/.pnpm/@openai+codex-sdk@0.142.5/node_modules/@openai/codex-sdk/dist/index.js
-import { promises as fs } from "fs";
-import os from "os";
-import path from "path";
-import { spawn } from "child_process";
-import { statSync as statSync2 } from "fs";
-import path2 from "path";
-import readline2 from "readline";
-import { createRequire } from "module";
-async function createOutputSchemaFile(schema) {
-  if (schema === void 0) {
-    return { cleanup: async () => {
-    } };
-  }
-  if (!isJsonObject(schema)) {
-    throw new Error("outputSchema must be a plain JSON object");
-  }
-  const schemaDir = await fs.mkdtemp(path.join(os.tmpdir(), "codex-output-schema-"));
-  const schemaPath = path.join(schemaDir, "schema.json");
-  const cleanup = async () => {
-    try {
-      await fs.rm(schemaDir, { recursive: true, force: true });
-    } catch {
-    }
-  };
-  try {
-    await fs.writeFile(schemaPath, JSON.stringify(schema), "utf8");
-    return { schemaPath, cleanup };
-  } catch (error) {
-    await cleanup();
-    throw error;
-  }
-}
-function isJsonObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var Thread = class {
-  _exec;
-  _options;
-  _id;
-  _threadOptions;
-  /** Returns the ID of the thread. Populated after the first turn starts. */
-  get id() {
-    return this._id;
-  }
-  /* @internal */
-  constructor(exec, options, threadOptions, id = null) {
-    this._exec = exec;
-    this._options = options;
-    this._id = id;
-    this._threadOptions = threadOptions;
-  }
-  /** Provides the input to the agent and streams events as they are produced during the turn. */
-  async runStreamed(input, turnOptions = {}) {
-    return { events: this.runStreamedInternal(input, turnOptions) };
-  }
-  async *runStreamedInternal(input, turnOptions = {}) {
-    const { schemaPath, cleanup } = await createOutputSchemaFile(turnOptions.outputSchema);
-    const options = this._threadOptions;
-    const { prompt, images } = normalizeInput(input);
-    const generator = this._exec.run({
-      input: prompt,
-      baseUrl: this._options.baseUrl,
-      apiKey: this._options.apiKey,
-      threadId: this._id,
-      images,
-      model: options?.model,
-      sandboxMode: options?.sandboxMode,
-      workingDirectory: options?.workingDirectory,
-      skipGitRepoCheck: options?.skipGitRepoCheck,
-      outputSchemaFile: schemaPath,
-      modelReasoningEffort: options?.modelReasoningEffort,
-      signal: turnOptions.signal,
-      networkAccessEnabled: options?.networkAccessEnabled,
-      webSearchMode: options?.webSearchMode,
-      webSearchEnabled: options?.webSearchEnabled,
-      approvalPolicy: options?.approvalPolicy,
-      additionalDirectories: options?.additionalDirectories
-    });
-    try {
-      for await (const item of generator) {
-        let parsed;
-        try {
-          parsed = JSON.parse(item);
-        } catch (error) {
-          throw new Error(`Failed to parse item: ${item}`, { cause: error });
-        }
-        if (parsed.type === "thread.started") {
-          this._id = parsed.thread_id;
-        }
-        yield parsed;
-      }
-    } finally {
-      await cleanup();
-    }
-  }
-  /** Provides the input to the agent and returns the completed turn. */
-  async run(input, turnOptions = {}) {
-    const generator = this.runStreamedInternal(input, turnOptions);
-    const items = [];
-    let finalResponse = "";
-    let usage = null;
-    let turnFailure = null;
-    for await (const event of generator) {
-      if (event.type === "item.completed") {
-        if (event.item.type === "agent_message") {
-          finalResponse = event.item.text;
-        }
-        items.push(event.item);
-      } else if (event.type === "turn.completed") {
-        usage = event.usage;
-      } else if (event.type === "turn.failed") {
-        turnFailure = event.error;
-        break;
-      }
-    }
-    if (turnFailure) {
-      throw new Error(turnFailure.message);
-    }
-    return { items, finalResponse, usage };
-  }
-};
-function normalizeInput(input) {
-  if (typeof input === "string") {
-    return { prompt: input, images: [] };
-  }
-  const promptParts = [];
-  const images = [];
-  for (const item of input) {
-    if (item.type === "text") {
-      promptParts.push(item.text);
-    } else if (item.type === "local_image") {
-      images.push(item.path);
-    }
-  }
-  return { prompt: promptParts.join("\n\n"), images };
-}
-var INTERNAL_ORIGINATOR_ENV = "CODEX_INTERNAL_ORIGINATOR_OVERRIDE";
-var TYPESCRIPT_SDK_ORIGINATOR = "codex_sdk_ts";
-var CODEX_NPM_NAME = "@openai/codex";
-var PLATFORM_PACKAGE_BY_TARGET = {
-  "x86_64-unknown-linux-musl": "@openai/codex-linux-x64",
-  "aarch64-unknown-linux-musl": "@openai/codex-linux-arm64",
-  "x86_64-apple-darwin": "@openai/codex-darwin-x64",
-  "aarch64-apple-darwin": "@openai/codex-darwin-arm64",
-  "x86_64-pc-windows-msvc": "@openai/codex-win32-x64",
-  "aarch64-pc-windows-msvc": "@openai/codex-win32-arm64"
-};
-var moduleRequire = createRequire(import.meta.url);
-var CodexExec = class {
-  executablePath;
-  pathDirs;
-  envOverride;
-  configOverrides;
-  constructor(executablePath = null, env, configOverrides) {
-    if (executablePath) {
-      this.executablePath = executablePath;
-      this.pathDirs = [];
-    } else {
-      const resolved = findCodexPath();
-      this.executablePath = resolved.executablePath;
-      this.pathDirs = resolved.pathDirs;
-    }
-    this.envOverride = env;
-    this.configOverrides = configOverrides;
-  }
-  async *run(args) {
-    const commandArgs = ["exec", "--experimental-json"];
-    if (this.configOverrides) {
-      for (const override of serializeConfigOverrides(this.configOverrides)) {
-        commandArgs.push("--config", override);
-      }
-    }
-    if (args.baseUrl) {
-      commandArgs.push(
-        "--config",
-        `openai_base_url=${toTomlValue(args.baseUrl, "openai_base_url")}`
-      );
-    }
-    if (args.model) {
-      commandArgs.push("--model", args.model);
-    }
-    if (args.sandboxMode) {
-      commandArgs.push("--sandbox", args.sandboxMode);
-    }
-    if (args.workingDirectory) {
-      commandArgs.push("--cd", args.workingDirectory);
-    }
-    if (args.additionalDirectories?.length) {
-      for (const dir of args.additionalDirectories) {
-        commandArgs.push("--add-dir", dir);
-      }
-    }
-    if (args.skipGitRepoCheck) {
-      commandArgs.push("--skip-git-repo-check");
-    }
-    if (args.outputSchemaFile) {
-      commandArgs.push("--output-schema", args.outputSchemaFile);
-    }
-    if (args.modelReasoningEffort) {
-      commandArgs.push("--config", `model_reasoning_effort="${args.modelReasoningEffort}"`);
-    }
-    if (args.networkAccessEnabled !== void 0) {
-      commandArgs.push(
-        "--config",
-        `sandbox_workspace_write.network_access=${args.networkAccessEnabled}`
-      );
-    }
-    if (args.webSearchMode) {
-      commandArgs.push("--config", `web_search="${args.webSearchMode}"`);
-    } else if (args.webSearchEnabled === true) {
-      commandArgs.push("--config", `web_search="live"`);
-    } else if (args.webSearchEnabled === false) {
-      commandArgs.push("--config", `web_search="disabled"`);
-    }
-    if (args.approvalPolicy) {
-      commandArgs.push("--config", `approval_policy="${args.approvalPolicy}"`);
-    }
-    if (args.threadId) {
-      commandArgs.push("resume", args.threadId);
-    }
-    if (args.images?.length) {
-      for (const image of args.images) {
-        commandArgs.push("--image", image);
-      }
-    }
-    const env = {};
-    if (this.envOverride) {
-      Object.assign(env, this.envOverride);
-    } else {
-      for (const [key, value] of Object.entries(process.env)) {
-        if (value !== void 0) {
-          env[key] = value;
-        }
-      }
-    }
-    if (!env[INTERNAL_ORIGINATOR_ENV]) {
-      env[INTERNAL_ORIGINATOR_ENV] = TYPESCRIPT_SDK_ORIGINATOR;
-    }
-    if (args.apiKey) {
-      env.CODEX_API_KEY = args.apiKey;
-    }
-    if (this.pathDirs.length > 0) {
-      prependPathDirs(env, this.pathDirs);
-    }
-    const child = spawn(this.executablePath, commandArgs, {
-      env,
-      signal: args.signal
-    });
-    let spawnError = null;
-    child.once("error", (err) => spawnError = err);
-    if (!child.stdin) {
-      child.kill();
-      throw new Error("Child process has no stdin");
-    }
-    child.stdin.write(args.input);
-    child.stdin.end();
-    if (!child.stdout) {
-      child.kill();
-      throw new Error("Child process has no stdout");
-    }
-    const stderrChunks = [];
-    if (child.stderr) {
-      child.stderr.on("data", (data) => {
-        stderrChunks.push(data);
-      });
-    }
-    const exitPromise = new Promise(
-      (resolve2) => {
-        child.once("exit", (code, signal) => {
-          resolve2({ code, signal });
-        });
-      }
-    );
-    const rl = readline2.createInterface({
-      input: child.stdout,
-      crlfDelay: Infinity
-    });
-    try {
-      for await (const line of rl) {
-        yield line;
-      }
-      if (spawnError) throw spawnError;
-      const { code, signal } = await exitPromise;
-      if (code !== 0 || signal) {
-        const stderrBuffer = Buffer.concat(stderrChunks);
-        const detail = signal ? `signal ${signal}` : `code ${code ?? 1}`;
-        throw new Error(`Codex Exec exited with ${detail}: ${stderrBuffer.toString("utf8")}`);
-      }
-    } finally {
-      rl.close();
-      child.removeAllListeners();
-      try {
-        if (!child.killed) child.kill();
-      } catch {
-      }
-    }
-  }
-};
-function serializeConfigOverrides(configOverrides) {
-  const overrides = [];
-  flattenConfigOverrides(configOverrides, "", overrides);
-  return overrides;
-}
-function flattenConfigOverrides(value, prefix, overrides) {
-  if (!isPlainObject(value)) {
-    if (prefix) {
-      overrides.push(`${prefix}=${toTomlValue(value, prefix)}`);
-      return;
-    } else {
-      throw new Error("Codex config overrides must be a plain object");
-    }
-  }
-  const entries = Object.entries(value);
-  if (!prefix && entries.length === 0) {
-    return;
-  }
-  if (prefix && entries.length === 0) {
-    overrides.push(`${prefix}={}`);
-    return;
-  }
-  for (const [key, child] of entries) {
-    if (!key) {
-      throw new Error("Codex config override keys must be non-empty strings");
-    }
-    if (child === void 0) {
-      continue;
-    }
-    const path3 = prefix ? `${prefix}.${key}` : key;
-    if (isPlainObject(child)) {
-      flattenConfigOverrides(child, path3, overrides);
-    } else {
-      overrides.push(`${path3}=${toTomlValue(child, path3)}`);
-    }
-  }
-}
-function toTomlValue(value, path3) {
-  if (typeof value === "string") {
-    return JSON.stringify(value);
-  } else if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new Error(`Codex config override at ${path3} must be a finite number`);
-    }
-    return `${value}`;
-  } else if (typeof value === "boolean") {
-    return value ? "true" : "false";
-  } else if (Array.isArray(value)) {
-    const rendered = value.map((item, index) => toTomlValue(item, `${path3}[${index}]`));
-    return `[${rendered.join(", ")}]`;
-  } else if (isPlainObject(value)) {
-    const parts = [];
-    for (const [key, child] of Object.entries(value)) {
-      if (!key) {
-        throw new Error("Codex config override keys must be non-empty strings");
-      }
-      if (child === void 0) {
-        continue;
-      }
-      parts.push(`${formatTomlKey(key)} = ${toTomlValue(child, `${path3}.${key}`)}`);
-    }
-    return `{${parts.join(", ")}}`;
-  } else if (value === null) {
-    throw new Error(`Codex config override at ${path3} cannot be null`);
-  } else {
-    const typeName = typeof value;
-    throw new Error(`Unsupported Codex config override value at ${path3}: ${typeName}`);
-  }
-}
-var TOML_BARE_KEY = /^[A-Za-z0-9_-]+$/;
-function formatTomlKey(key) {
-  return TOML_BARE_KEY.test(key) ? key : JSON.stringify(key);
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function findCodexPath() {
-  const { platform, arch } = process;
-  let targetTriple = null;
-  switch (platform) {
-    case "linux":
-    case "android":
-      switch (arch) {
-        case "x64":
-          targetTriple = "x86_64-unknown-linux-musl";
-          break;
-        case "arm64":
-          targetTriple = "aarch64-unknown-linux-musl";
-          break;
-        default:
-          break;
-      }
-      break;
-    case "darwin":
-      switch (arch) {
-        case "x64":
-          targetTriple = "x86_64-apple-darwin";
-          break;
-        case "arm64":
-          targetTriple = "aarch64-apple-darwin";
-          break;
-        default:
-          break;
-      }
-      break;
-    case "win32":
-      switch (arch) {
-        case "x64":
-          targetTriple = "x86_64-pc-windows-msvc";
-          break;
-        case "arm64":
-          targetTriple = "aarch64-pc-windows-msvc";
-          break;
-        default:
-          break;
-      }
-      break;
-    default:
-      break;
-  }
-  if (!targetTriple) {
-    throw new Error(`Unsupported platform: ${platform} (${arch})`);
-  }
-  const platformPackage = PLATFORM_PACKAGE_BY_TARGET[targetTriple];
-  if (!platformPackage) {
-    throw new Error(`Unsupported target triple: ${targetTriple}`);
-  }
-  let vendorRoot;
-  try {
-    const codexPackageJsonPath = moduleRequire.resolve(`${CODEX_NPM_NAME}/package.json`);
-    const codexRequire = createRequire(codexPackageJsonPath);
-    const platformPackageJsonPath = codexRequire.resolve(`${platformPackage}/package.json`);
-    vendorRoot = path2.join(path2.dirname(platformPackageJsonPath), "vendor");
-  } catch {
-    throw new Error(
-      `Unable to locate Codex CLI binaries. Ensure ${CODEX_NPM_NAME} is installed with optional dependencies.`
-    );
-  }
-  const codexBinaryName = process.platform === "win32" ? "codex.exe" : "codex";
-  const nativePackage = resolveNativePackage(vendorRoot, targetTriple, codexBinaryName);
-  if (!nativePackage) {
-    throw new Error(
-      `Unable to locate Codex CLI binaries for ${targetTriple}. Ensure ${CODEX_NPM_NAME} is installed with optional dependencies.`
-    );
-  }
-  return nativePackage;
-}
-function resolveNativePackage(vendorRoot, targetTriple, codexBinaryName) {
-  const packageRoot = path2.join(vendorRoot, targetTriple);
-  const packageBinaryPath = path2.join(packageRoot, "bin", codexBinaryName);
-  if (isFile(packageBinaryPath) && isFile(path2.join(packageRoot, "codex-package.json"))) {
-    return {
-      executablePath: packageBinaryPath,
-      pathDirs: existingDirs(path2.join(packageRoot, "codex-path"))
-    };
-  }
-  const legacyBinaryPath = path2.join(packageRoot, "codex", codexBinaryName);
-  if (isFile(legacyBinaryPath)) {
-    return {
-      executablePath: legacyBinaryPath,
-      pathDirs: existingDirs(path2.join(packageRoot, "path"))
-    };
-  }
-  return null;
-}
-function existingDirs(...dirs) {
-  return dirs.filter(isDirectory);
-}
-function prependPathDirs(env, pathDirs, platform = process.platform) {
-  const pathKey = pathEnvKey(env, platform);
-  if (platform === "win32") {
-    for (const key of Object.keys(env)) {
-      if (key.toLowerCase() === "path" && key !== pathKey) {
-        delete env[key];
-      }
-    }
-  }
-  const existingEntries = (env[pathKey] ?? "").split(path2.delimiter).filter((entry) => entry.length > 0 && !pathDirs.includes(entry));
-  env[pathKey] = [...pathDirs, ...existingEntries].join(path2.delimiter);
-}
-function pathEnvKey(env, platform) {
-  if (platform !== "win32") {
-    return "PATH";
-  }
-  const matchingKeys = Object.keys(env).filter((key) => key.toLowerCase() === "path");
-  return matchingKeys.includes("Path") ? "Path" : matchingKeys.at(-1) ?? "PATH";
-}
-function isFile(filePath) {
-  try {
-    return statSync2(filePath).isFile();
-  } catch {
-    return false;
-  }
-}
-function isDirectory(filePath) {
-  try {
-    return statSync2(filePath).isDirectory();
-  } catch {
-    return false;
-  }
-}
-var Codex = class {
-  exec;
-  options;
-  constructor(options = {}) {
-    const { codexPathOverride, env, config } = options;
-    this.exec = new CodexExec(codexPathOverride, env, config);
-    this.options = options;
-  }
-  /**
-   * Starts a new conversation with an agent.
-   * @returns A new thread instance.
-   */
-  startThread(options = {}) {
-    return new Thread(this.exec, this.options, options);
-  }
-  /**
-   * Resumes a conversation with an agent based on the thread id.
-   * Threads are persisted in ~/.codex/sessions.
-   *
-   * @param id The id of the thread to resume.
-   * @returns A new thread instance.
-   */
-  resumeThread(id, options = {}) {
-    return new Thread(this.exec, this.options, options, id);
-  }
-};
-
 // src/session/runner/codex.ts
+import { Codex } from "@openai/codex-sdk";
 var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var str = (v) => typeof v === "string" ? v : void 0;
 var compactEnv = (env) => {
@@ -7177,13 +6671,20 @@ async function* startCodexEvents(config, input, worker2, opts) {
   const codex = new Codex(env ? { env } : void 0);
   const resuming = !config.agentSessionId.startsWith("pending:");
   const addDirs = additionalDirs();
+  const sandboxMode = codexSandboxMode(opts.planMode ?? false);
+  const approvalPolicy = codexApprovalPolicy();
+  const networkAccessEnabled = codexNetworkAccess();
+  opts.log(
+    `[codex] sandbox=${sandboxMode} approval=${approvalPolicy}${networkAccessEnabled === void 0 ? "" : ` network=${networkAccessEnabled}`}`
+  );
   const threadOptions = {
     workingDirectory: config.worktreePath,
     skipGitRepoCheck: true,
-    sandboxMode: opts.planMode ? "read-only" : "workspace-write",
-    approvalPolicy: "never",
+    sandboxMode,
+    approvalPolicy,
     ...opts.model ? { model: opts.model } : {},
-    ...addDirs ? { additionalDirectories: addDirs } : {}
+    ...addDirs ? { additionalDirectories: addDirs } : {},
+    ...networkAccessEnabled === void 0 ? {} : { networkAccessEnabled }
   };
   const thread = resuming ? codex.resumeThread(config.agentSessionId, threadOptions) : codex.startThread(threadOptions);
   const runInput = opts.planMode ? withPlanPrefix(input) : input;
@@ -7302,12 +6803,12 @@ var startedItemFromToolUse = (block) => {
     };
   }
   if (name === "Edit" || name === "Write" || name === "MultiEdit" || name === "Delete") {
-    const path3 = pathOf(input);
+    const path = pathOf(input);
     return {
       type: "file_change",
       id,
       status: "in_progress",
-      changes: path3 ? [{ path: path3, kind: fileKindOf(name) }] : []
+      changes: path ? [{ path, kind: fileKindOf(name) }] : []
     };
   }
   const mcp = mcpParts(name);
@@ -8115,7 +7616,7 @@ var createLiveness = (deps) => {
 };
 
 // src/worker/session-supervisor.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync as existsSync5 } from "node:fs";
 import { dirname as dirname2, join as join7 } from "node:path";
@@ -8248,12 +7749,12 @@ var ensureExcluded = (repo, pattern) => {
     });
     if (r.status !== 0) return;
     const rel = r.stdout.trim();
-    const path3 = isAbsolute2(rel) ? rel : resolve(repo, rel);
-    const current = existsSync4(path3) ? readFileSync5(path3, "utf8") : "";
+    const path = isAbsolute2(rel) ? rel : resolve(repo, rel);
+    const current = existsSync4(path) ? readFileSync5(path, "utf8") : "";
     if (current.split("\n").includes(pattern)) return;
-    mkdirSync3(dirname(path3), { recursive: true });
+    mkdirSync3(dirname(path), { recursive: true });
     const sep = current === "" || current.endsWith("\n") ? "" : "\n";
-    appendFileSync(path3, `${sep}${pattern}
+    appendFileSync(path, `${sep}${pattern}
 `, "utf8");
   } catch {
   }
@@ -8300,7 +7801,7 @@ var createSessionSupervisor = (deps) => {
   const children = /* @__PURE__ */ new Map();
   const spawnChild = (sessionId, worktreePath) => {
     if (children.has(sessionId)) return;
-    const child = spawn2(process.execPath, [binPath(), "session", "run", String(sessionId)], {
+    const child = spawn(process.execPath, [binPath(), "session", "run", String(sessionId)], {
       detached: true,
       stdio: "inherit",
       env: { ...process.env, BATON_SERVER: cfg.server, BATON_WORKER_TOKEN: cfg.apiToken }
@@ -8406,7 +7907,7 @@ var createSessionSupervisor = (deps) => {
 
 // src/worker/terminal-manager.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { spawn as spawn3 } from "node-pty";
+import { spawn as spawn2 } from "node-pty";
 
 // ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/wrapper.mjs
 var import_stream2 = __toESM(require_stream(), 1);
@@ -8445,7 +7946,7 @@ var createTerminalManager = (deps) => {
       return;
     }
     const claudeBin = process.env.BATON_CLAUDE_BIN ?? "claude";
-    const term = spawn3(claudeBin, ptyArgs(agentSessionId, hasSessionJsonl(agentSessionId)), {
+    const term = spawn2(claudeBin, ptyArgs(agentSessionId, hasSessionJsonl(agentSessionId)), {
       name: "xterm-color",
       cols: 80,
       rows: 24,
@@ -8598,14 +8099,14 @@ import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as rea
 import { homedir as homedir4 } from "node:os";
 import { dirname as dirname3, join as join9 } from "node:path";
 var machineIdPath = (env = process.env) => join9(env.XDG_DATA_HOME ?? join9(env.HOME ?? homedir4(), ".local/share"), "baton", "machine-id");
-var readOrCreateMachineId = (path3 = machineIdPath()) => {
-  if (existsSync8(path3)) {
-    const s = readFileSync6(path3, "utf8").trim();
+var readOrCreateMachineId = (path = machineIdPath()) => {
+  if (existsSync8(path)) {
+    const s = readFileSync6(path, "utf8").trim();
     if (s) return s;
   }
   const id = randomUUID2();
-  mkdirSync4(dirname3(path3), { recursive: true });
-  writeFileSync5(path3, `${id}
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeFileSync5(path, `${id}
 `, "utf8");
   return id;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lesscap/baton-cli",
-  "version": "0.4.3",
+  "version": "0.5.1",
   "license": "MIT",
   "publishConfig": {
     "access": "public"