@lyupro/codex-bridge 0.5.2 → 0.5.4

package/src/home/lib/runner/codex-cmd.mjs

@@ -1,12 +1,11 @@
 /**
- * Everything about invoking the `codex` CLI: which flags a run gets, whether the CLI is
- * there at all, and how its JSONL stdout reaches events.jsonl while stderr stays separate.
+ * Invoking the `codex` CLI: starting it, stopping its whole tree, telling whether it is there at
+ * all, and keeping its JSONL stdout in events.jsonl while stderr stays separate.
  *
- * The flag sets below are the ones the three agent files carried before, verbatim.
- * Sandboxes especially must not drift: codex-scout is read-only through
- * --ignore-user-config, codex-build needs workspace-write and must NOT get
- * --ignore-user-config, codex-review needs an explicit --sandbox read-only before the
- * `review` subcommand.
+ * Which flags a run gets is the neighbouring codex-args.mjs: this file starts the process and
+ * stops it, and knows nothing about what the arguments mean. The two were one module until it
+ * outgrew the size limit, and the seam is the honest one — "how we run Codex" against "what we
+ * ask it to run".
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -14,7 +13,6 @@ import { spawn, spawnSync } from 'node:child_process';
 import { createHeartbeat, HEARTBEAT_INTERVAL_MS } from '../heartbeat.mjs';
 import { writeFailure } from '../write-meta.mjs';
 import { MAX_LOG } from './git-state.mjs';
-import { CLEAN_ENV, RUN_ENV } from './run-env.mjs';
 
 // Thirty seconds, not a fraction of one: after `exit` the pipe still holds whatever Codex wrote
 // last, and that tail carries `item.completed` — the result the verdict is read from. A quarter
@@ -268,125 +266,3 @@ export function requireCodex(runDir, agent) {
     process.exit(1);
   }
 }
-
-/**
- * Which model runs a mode, and how deep it reasons.
- *
- * Three sources, in this order: what the dispatcher asked for this one task, the mode's
- * configured profile, and finally a depth to fall back on. The order is the whole point —
- * pinning a model without its depth leaves every run at the fallback, which is how a mode
- * configured for maximum reasoning would quietly keep working at the shallowest setting.
- */
-const FALLBACK_EFFORT = 'medium';
-
-/**
- * A run is one worker, not a team it recruits for itself.
- *
- * Codex can spawn subagents when a prompt asks it to, and their edits land in the same
- * worktree — so they arrive in the snapshot as the run's own work, outside the scope check
- * that grades it, on quota nobody budgeted. The prompts say not to; this is why they cannot.
- */
-const NO_SUBAGENTS = ['-c', 'agents.enabled=false'];
-
-/**
- * Which configured mode an agent is. One table, because the launcher needs the same answer to
- * pick a run's time budget: a second copy of this mapping is a second place to forget a mode.
- */
-export const runMode = (agent) =>
-  ({
-    'codex-scout': 'scout',
-    'codex-build': 'build',
-    'codex-review': 'review',
-  })[agent];
-
-function runProfile(opts) {
-  const mode = runMode(opts.agent);
-  // opts.models is how tests state a configuration; a real run reads the one loaded for it.
-  const configured = (opts.models || RUN_ENV?.models || {})[mode] || {};
-  return {
-    model: configured.model || '',
-    effort: opts.effort || configured.effort || FALLBACK_EFFORT,
-  };
-}
-
-export function codexArgs(opts, runDir, isGitRepo) {
-  const schema = path.join(runDir, 'schema.json');
-  const profile = runProfile(opts);
-  const effort = `model_reasoning_effort=${profile.effort}`;
-  const modelArgs = profile.model ? ['-m', profile.model] : [];
-  if (opts.agent === 'codex-scout') {
-    return [
-      'exec',
-      '--json',
-      ...CLEAN_ENV,
-      '--ignore-user-config',
-      '-c',
-      effort,
-      ...NO_SUBAGENTS,
-      ...modelArgs,
-      '--sandbox',
-      'read-only',
-      '--skip-git-repo-check',
-      '-C',
-      opts.repo,
-      '--output-schema',
-      schema,
-      '-o',
-      path.join(runDir, 'result.json'),
-      '-',
-    ];
-  }
-  if (opts.agent === 'codex-build') {
-    // --ignore-user-config is deliberately absent: with it Codex forces read-only and
-    // every edit is rejected ("writing is blocked by read-only sandbox").
-    return [
-      'exec',
-      '--json',
-      ...CLEAN_ENV,
-      '-c',
-      effort,
-      ...NO_SUBAGENTS,
-      ...modelArgs,
-      '--sandbox',
-      'workspace-write',
-      '-C',
-      opts.repo,
-      ...(isGitRepo ? [] : ['--skip-git-repo-check']),
-      '--output-schema',
-      schema,
-      '-o',
-      path.join(runDir, 'result.json'),
-      '-',
-    ];
-  }
-  // codex-review deliberately does NOT use the `review` subcommand. Two of its traits
-  // break the contract this design rests on: it rejects a scope flag together with a
-  // prompt ("the argument '--uncommitted' cannot be used with '[PROMPT]'"), so task.md
-  // was silently discarded and the review rules never arrived; and it ignores
-  // --output-schema, writing prose into -o, so the old JSON parsing of review.json could
-  // only ever fail — which is what pushed a dispatcher into reviewing the diff itself.
-  //
-  // Plain `codex exec` honours the schema (proven by codex-scout), so the review comes
-  // back as machine-checkable JSON. Scope lives in the prompt as a file list plus the
-  // exact diff command computed by reviewScope(). Read-only through
-  // --ignore-user-config, same as scout: review never needs write access.
-  return [
-    'exec',
-    '--json',
-    ...CLEAN_ENV,
-    '--ignore-user-config',
-    '-c',
-    effort,
-    ...NO_SUBAGENTS,
-    ...modelArgs,
-    '--sandbox',
-    'read-only',
-    '-C',
-    opts.repo,
-    '--output-schema',
-    schema,
-    '-o',
-    path.join(runDir, 'review.json'),
-    '-',
-  ];
-}

package/src/home/lib/runner/launcher.mjs

@@ -2,15 +2,9 @@
  * The half the caller can kill: every preparation and every refusal that costs no quota,
  * then the spawn of the worker and the immediate return; a repeated call waits for the reply.
  *
- * The order it leaves for the worker is worker.json in the run folder — after the split
- * that file is the only connection between the two halves. It is written here with
- * `agent`, `slug`, `order_id`, `repo`, `is_git_repo`, `launcher_pid`, `budget_minutes`, `scope_new`
- * and `args`;
- * worker.mjs reads `repo`, `agent`, `args`, `is_git_repo` and `budget_minutes`. The extra fields
- * are deliberate: `slug`, `order_id`, `launcher_pid` and `scope_new` are what a run folder read
- * back months later needs in order to explain itself — which order it belonged to and which new
- * paths it declared included. Nothing may be dropped from this shape without changing worker.mjs
- * and saying so out loud.
+ * The order it leaves for the worker is worker.json in the run folder — after the split that file
+ * is the only connection between the two halves. Its shape and the reason for every field live in
+ * worker-order.mjs, which writes it.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -37,7 +31,9 @@ import { continuationRefusal } from './continuation.mjs';
 import { SCHEMAS } from './schemas.mjs';
 import { INSTRUCTIONS } from './prompts.mjs';
 import { git, headSha, branchName, worktreeSnapshot, reviewScope } from './git-state.mjs';
-import { codexArgs, requireCodex, runMode, unsafeForCmd } from './codex-cmd.mjs';
+import { codexArgs, runMode, runProfile } from './codex-args.mjs';
+import { writeWorkerOrder } from './worker-order.mjs';
+import { requireCodex, unsafeForCmd } from './codex-cmd.mjs';
 import { runsRoot } from './runs-root.mjs';
 import { resolveProjectRunsDir } from './project-dir.mjs';
 import { cleanupRetention } from '../retention.mjs';
@@ -344,26 +340,18 @@ export async function launcher(argv = process.argv.slice(2)) {
     console.log(reply);
     return 1;
   }
-  fs.writeFileSync(
-    path.join(runDir, 'worker.json'),
-    `${JSON.stringify(
-      {
-        agent: opts.agent,
-        slug: opts.slug,
-        order_id: opts.orderId,
-        repo: repoRoot,
-        is_git_repo: isGitRepo,
-        launcher_pid: process.pid,
-        // The mode's wall-clock budget, resolved here and never re-read by the worker: a run
-        // that consulted config.json twice could end up honouring two different limits.
-        budget_minutes: RUN_ENV?.budgets?.[runMode(opts.agent)],
-        scope_new: opts.scopeNewPatterns,
-        args: codexArgv,
-      },
-      null,
-      2,
-    )}\n`,
-  );
+  writeWorkerOrder(runDir, {
+    agent: opts.agent,
+    slug: opts.slug,
+    orderId: opts.orderId,
+    repo: repoRoot,
+    isGitRepo,
+    launcherPid: process.pid,
+    budgetMinutes: RUN_ENV?.budgets?.[runMode(opts.agent)],
+    scopeNew: opts.scopeNewPatterns,
+    profile: runProfile({ ...opts, repo: repoRoot }),
+    args: codexArgv,
+  });
 
   // detached + unref + no stdio: the worker leaves the caller's process group, so a Ctrl+C
   // or a timeout kill aimed at the dispatcher's shell does not reach it, and it holds no

package/src/home/lib/runner/sandbox-flags.mjs

@@ -0,0 +1,27 @@
+/**
+ * Platform flags a delegated run needs before its sandbox can start a process at all.
+ *
+ * codex-cli 0.149.0 on Windows runs sandboxed commands under a restricted token, and which token
+ * it builds is `windows.sandbox` — `elevated` or `unelevated`. The unelevated form refuses
+ * CreateProcess outright: every command the model tries comes back as
+ * `Rejected("… rejected: blocked by policy")` before the process exists. That setting lives in the
+ * operator's own config.toml, which `--ignore-user-config` deliberately drops, so on 2026-08-23
+ * every codex-scout and codex-review run died without reading a single file while codex-build
+ * kept working — not because writing is exempt, but because it is the one agent that does not pass
+ * `--ignore-user-config` and so inherited the operator's key by luck. Four probes on the installed
+ * CLI, differing by this flag alone, separate the two: with the key a run prints its command output
+ * and exits 0, without it both read-only AND workspace-write are refused.
+ *
+ * Naming the flag here keeps the isolation intact — a run still ignores the operator's config —
+ * and stops the package from depending on a line in a personal file it does not own.
+ *
+ * The value carries no quotes on purpose: unsafeForCmd() refuses any argument containing `"`,
+ * because the whole command line goes through cmd.exe. Codex parses `elevated` as a bare TOML
+ * literal, and rejects an unknown variant loudly, so the unquoted form is checked, not assumed.
+ */
+export const WINDOWS_SANDBOX = ['-c', 'windows.sandbox=elevated'];
+
+/** Empty off Windows: no other platform has this setting, and passing it would be an error. */
+export function platformSandboxArgs(platform = process.platform) {
+  return platform === 'win32' ? [...WINDOWS_SANDBOX] : [];
+}

package/src/home/lib/runner/worker-order.mjs

@@ -0,0 +1,56 @@
+/**
+ * The order the launcher leaves for the worker: worker.json in the run folder.
+ *
+ * After the launcher/worker split this file is the only connection between the two halves, and the
+ * worker never re-reads the CLI or the configuration — a run that consulted config.json twice could
+ * end up honouring two different limits. It carries `agent`, `slug`, `order_id`, `repo`,
+ * `is_git_repo`, `launcher_pid`, `budget_minutes`, `scope_new`, `profile` and `args`; worker.mjs
+ * reads `repo`, `agent`, `args`, `is_git_repo` and `budget_minutes`. The rest is deliberate: those
+ * fields are what a run folder read back months later needs in order to explain itself — which
+ * order it belonged to, which new paths it declared included, and which worker was actually
+ * ordered. Nothing may be dropped from this shape without changing worker.mjs and saying so out
+ * loud; `docs/worker-contract.md` is the document that says it.
+ *
+ * It lives beside launcher.mjs rather than inside it because writing this contract is its own job,
+ * and the launcher had grown past the size limit while the contract was buried in the middle of it.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function workerOrder({
+  agent,
+  slug,
+  orderId,
+  repo,
+  isGitRepo,
+  launcherPid,
+  budgetMinutes,
+  scopeNew,
+  profile,
+  args,
+}) {
+  return {
+    agent,
+    slug,
+    order_id: orderId,
+    repo,
+    is_git_repo: isGitRepo,
+    launcher_pid: launcherPid,
+    // The mode's wall-clock budget, resolved by the launcher and never re-read by the worker.
+    budget_minutes: budgetMinutes,
+    scope_new: scopeNew,
+    // Which worker was ordered, and where each half of that answer came from. Recorded separately
+    // from args because an absent flag says nothing: a run without `-m` looked exactly like a run
+    // whose configured model had never been read, which is how a pinned profile went unnoticed for
+    // three releases (2026-08-26).
+    profile,
+    args,
+  };
+}
+
+export function writeWorkerOrder(runDir, fields) {
+  fs.writeFileSync(
+    path.join(runDir, 'worker.json'),
+    `${JSON.stringify(workerOrder(fields), null, 2)}\n`,
+  );
+}

package/src/home/lib/write-meta.mjs

@@ -28,7 +28,7 @@ import { splitRunChanges } from './meta/environment.mjs';
 import { readEvents } from './meta/events.mjs';
 import { writeStatus } from './meta/run-state.mjs';
 import { resolveStatus } from './meta/verdict.mjs';
-import { AGENTS, failReply, limitReply } from './meta/reply.mjs';
+import { AGENTS, failReply, limitReply, withProfileRow } from './meta/reply.mjs';
 
 function readRunnerVersion() {
   try {
@@ -122,7 +122,12 @@ export function collect(runDir, agent, exitCode) {
     tokens: events.tokens,
     tokens_reported: events.tokens !== null,
     usage: events.usage,
-    model: argValue('-m'),
+    // The ordered profile, straight from worker.json; null for runs made before it was recorded.
+    // `model` stays for readers that already know it, and now answers for a run that pinned
+    // nothing instead of going quiet: an absent -m used to be indistinguishable from a model
+    // the operator had configured and never received (2026-08-26).
+    profile: worker?.profile ?? null,
+    model: worker?.profile?.model || argValue('-m'),
     sandbox: argValue('--sandbox'),
     // Null for runs made before env.json existed: absence is not the same as "both off".
     env: readJson(path.join(runDir, 'env.json')),
@@ -143,7 +148,10 @@ export function collect(runDir, agent, exitCode) {
     file: (name) => path.join(runDir, name),
   };
   const reply =
-    status === 'OK' ? cfg.reply(ctx) : status === 'LIMIT' ? limitReply(ctx, meta) : failReply(ctx, meta);
+    withProfileRow(
+      status === 'OK' ? cfg.reply(ctx) : status === 'LIMIT' ? limitReply(ctx, meta) : failReply(ctx, meta),
+      meta,
+    );
 
   return { meta, reply: reply.join('\n') };
 }