@lyupro/codex-bridge 0.5.3 → 0.5.5

package/src/home/lib/run-config.mjs

@@ -19,10 +19,18 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { BRAND_CONFIG_PATH, BRAND_HOME } from './brand-home.mjs';
 import { readJsonFileSync } from './json-file.mjs';
 
-const HERE = path.dirname(fileURLToPath(import.meta.url));
-export const CONFIG_PATH = path.join(HERE, '..', 'config.json');
+export const CONFIG_PATH = BRAND_CONFIG_PATH;
+
+/**
+ * Every print of the state says which file was read AND why that one. The defect this replaced was
+ * invisible precisely because the path was never shown beside its origin: two files named
+ * config.json, and no way to tell from the output which of them the run had just used.
+ */
+const ORIGIN =
+  BRAND_HOME.source === 'CODEX_BRIDGE_HOME' ? 'from CODEX_BRIDGE_HOME' : 'default location';
 
 const BUDGET_KEY = 'budgets';
 const BUDGET_MODES = ['scout', 'build', 'review'];
@@ -73,7 +81,11 @@ const MODEL_KEYS = ['scout', 'build', 'review'];
  * fallback depth the dispatcher happens to pass.
  */
 const PROFILE_KEYS = ['model', 'effort'];
-export const ALLOWED_EFFORTS = Object.freeze(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
+// Exactly the values the service enumerates, and no more. `minimal` sat here until 2026-08-26,
+// passed validation and was rejected by the model itself after the run had started
+// ("Unsupported value: 'minimal' is not supported with the … model"), so an order died four
+// seconds in on quota already spent. A validator that admits a known-dead value is worse than none.
+export const ALLOWED_EFFORTS = Object.freeze(['none', 'low', 'medium', 'high', 'xhigh', 'max']);
 /**
  * The language a run answers in. Left to the model it followed the task, the surrounding docs or
  * its own default: an English order came back in Russian, and artifacts of one project ended up in
@@ -308,13 +320,13 @@ function main(argv) {
 
   if (!key) {
     const config = readRunConfig();
-    console.log([...state(config), `File: ${CONFIG_PATH}`].join('\n'));
+    console.log([...state(config), `File: ${CONFIG_PATH} (${ORIGIN})`].join('\n'));
     return 0;
   }
 
   if (key === 'reset') {
     writeRunConfig({ ...DEFAULTS });
-    console.log([...state(DEFAULTS), `Reset to defaults · ${CONFIG_PATH}`].join('\n'));
+    console.log([...state(DEFAULTS), `Reset to defaults · ${CONFIG_PATH} (${ORIGIN})`].join('\n'));
     return 0;
   }
 
@@ -334,7 +346,7 @@ function main(argv) {
 
   const config = { ...readRunConfig(), [key]: value === 'on' };
   writeRunConfig(config);
-  console.log([...state(config), `File: ${CONFIG_PATH}`].join('\n'));
+  console.log([...state(config), `File: ${CONFIG_PATH} (${ORIGIN})`].join('\n'));
   return 0;
 }
 

package/src/home/lib/runner/codex-args.mjs

@@ -0,0 +1,154 @@
+/**
+ * What a run asks Codex to do: the model, the reasoning depth and the flag set per agent.
+ *
+ * Split out of codex-cmd.mjs when that file outgrew the size limit; the seam is deliberate, not
+ * arithmetic — starting a process and deciding what it is asked to do are different jobs, and
+ * only this half needs to know the run's configuration.
+ *
+ * The flag sets are the ones the three agent files carried before, verbatim. Sandboxes especially
+ * must not drift: codex-scout and codex-review are read-only through an explicit --sandbox
+ * read-only, and codex-build needs workspace-write and must NOT get --ignore-user-config. What
+ * --ignore-user-config buys the two read-only agents is isolation from the operator's config,
+ * never the sandbox itself — reading it as the read-only guarantee is how the 2026-08-23 breakage
+ * stayed misdiagnosed as "read-only is broken" (see sandbox-flags.mjs for what actually stops a
+ * run from starting a process on Windows).
+ */
+import path from 'node:path';
+import { CLEAN_ENV, RUN_ENV } from './run-env.mjs';
+import { platformSandboxArgs } from './sandbox-flags.mjs';
+
+/**
+ * Which model runs a mode, and how deep it reasons.
+ *
+ * Three sources, in this order: what the dispatcher asked for this one task, the mode's
+ * configured profile, and finally a depth to fall back on. The order is the whole point —
+ * pinning a model without its depth leaves every run at the fallback, which is how a mode
+ * configured for maximum reasoning would quietly keep working at the shallowest setting.
+ */
+const FALLBACK_EFFORT = 'medium';
+
+/**
+ * A run is one worker, not a team it recruits for itself.
+ *
+ * Codex can spawn subagents when a prompt asks it to, and their edits land in the same
+ * worktree — so they arrive in the snapshot as the run's own work, outside the scope check
+ * that grades it, on quota nobody budgeted. The prompts say not to; this is why they cannot.
+ */
+const NO_SUBAGENTS = ['-c', 'agents.enabled=false'];
+
+/**
+ * Which configured mode an agent is. One table, because the launcher needs the same answer to
+ * pick a run's time budget: a second copy of this mapping is a second place to forget a mode.
+ */
+export const runMode = (agent) =>
+  ({
+    'codex-scout': 'scout',
+    'codex-build': 'build',
+    'codex-review': 'review',
+  })[agent];
+
+/**
+ * Which model and depth this run gets, and — as part of the same answer — where each came from.
+ *
+ * The provenance is not decoration. A configured profile failed to reach any run for three
+ * releases (2026-08-26) and nothing said so: the reply named no model, meta.json recorded none,
+ * and a depth silently served by the fallback is indistinguishable from one the operator chose.
+ * `model_source` is `config` or `codex default`; `effort_source` is `request`, `config` or
+ * `fallback`, in the order the values are consulted above.
+ */
+export function runProfile(opts) {
+  const mode = runMode(opts.agent);
+  // opts.models is how tests state a configuration; a real run reads the one loaded for it.
+  const configured = (opts.models || RUN_ENV?.models || {})[mode] || {};
+  return {
+    model: configured.model || '',
+    model_source: configured.model ? 'config' : 'codex default',
+    effort: opts.effort || configured.effort || FALLBACK_EFFORT,
+    effort_source: opts.effort ? 'request' : configured.effort ? 'config' : 'fallback',
+  };
+}
+
+export function codexArgs(opts, runDir, isGitRepo) {
+  const schema = path.join(runDir, 'schema.json');
+  const profile = runProfile(opts);
+  const effort = `model_reasoning_effort=${profile.effort}`;
+  const modelArgs = profile.model ? ['-m', profile.model] : [];
+  if (opts.agent === 'codex-scout') {
+    return [
+      'exec',
+      '--json',
+      ...CLEAN_ENV,
+      '--ignore-user-config',
+      '-c',
+      effort,
+      ...NO_SUBAGENTS,
+      ...platformSandboxArgs(),
+      ...modelArgs,
+      '--sandbox',
+      'read-only',
+      '--skip-git-repo-check',
+      '-C',
+      opts.repo,
+      '--output-schema',
+      schema,
+      '-o',
+      path.join(runDir, 'result.json'),
+      '-',
+    ];
+  }
+  if (opts.agent === 'codex-build') {
+    // --ignore-user-config is deliberately absent: with it Codex forces read-only and
+    // every edit is rejected ("writing is blocked by read-only sandbox").
+    return [
+      'exec',
+      '--json',
+      ...CLEAN_ENV,
+      '-c',
+      effort,
+      ...NO_SUBAGENTS,
+      ...platformSandboxArgs(),
+      ...modelArgs,
+      '--sandbox',
+      'workspace-write',
+      '-C',
+      opts.repo,
+      ...(isGitRepo ? [] : ['--skip-git-repo-check']),
+      '--output-schema',
+      schema,
+      '-o',
+      path.join(runDir, 'result.json'),
+      '-',
+    ];
+  }
+  // codex-review deliberately does NOT use the `review` subcommand. Two of its traits
+  // break the contract this design rests on: it rejects a scope flag together with a
+  // prompt ("the argument '--uncommitted' cannot be used with '[PROMPT]'"), so task.md
+  // was silently discarded and the review rules never arrived; and it ignores
+  // --output-schema, writing prose into -o, so the old JSON parsing of review.json could
+  // only ever fail — which is what pushed a dispatcher into reviewing the diff itself.
+  //
+  // Plain `codex exec` honours the schema (proven by codex-scout), so the review comes
+  // back as machine-checkable JSON. Scope lives in the prompt as a file list plus the
+  // exact diff command computed by reviewScope(). Read-only through
+  // --ignore-user-config, same as scout: review never needs write access.
+  return [
+    'exec',
+    '--json',
+    ...CLEAN_ENV,
+    '--ignore-user-config',
+    '-c',
+    effort,
+    ...NO_SUBAGENTS,
+    ...platformSandboxArgs(),
+    ...modelArgs,
+    '--sandbox',
+    'read-only',
+    '-C',
+    opts.repo,
+    '--output-schema',
+    schema,
+    '-o',
+    path.join(runDir, 'review.json'),
+    '-',
+  ];
+}