@lyupro/codex-bridge 0.6.2 → 0.6.4

package/src/home/lib/runner/launcher.mjs

@@ -15,7 +15,6 @@ import {
   writeStatus,
   markAbandoned,
   abandonedBranchDrift,
-  activeRunDetails,
   chainRuns,
   startedRuns,
   taskFingerprint,
@@ -34,12 +33,14 @@ import { git, headSha, branchName, worktreeSnapshot, reviewScope } from './git-s
 import { agentRole } from '../agents.mjs';
 import { codexArgs, runProfile } from './codex-args.mjs';
 import { writeWorkerOrder } from './worker-order.mjs';
-import { requireCodex, unsafeForCmd } from './codex-cmd.mjs';
+import { unsafeForCmd } from './codex-cmd.mjs';
 import { runsRoot } from './runs-root.mjs';
 import { resolveProjectRunsDir } from './project-dir.mjs';
 import { cleanupRetention } from '../retention.mjs';
 import { renderConventions } from './conventions.mjs';
 import { validateScope } from './scope-check.mjs';
+import { probeSandbox, sandboxRefusal } from './sandbox-probe.mjs';
+import { preflightRefusal } from './preflight.mjs';
 
 /**
  * The worker is this same program re-invoked as `--worker <runDir>`, so the path spawned
@@ -86,7 +87,7 @@ export const runDirPath = (root, slug, runStamp = stamp()) => {
 /**
  * Everything a run needs before a single token of someone else's quota is spent, and every
  * refusal that costs nothing: bad arguments, an open chain without --continue, a busy
- * worktree, a missing Codex CLI. All of it happens here, in the process the caller is free
+ * worktree, a dead Codex sandbox, a missing Codex CLI. All in the process the caller is free
  * to kill — so a killed caller can only ever interrupt a run that was already paid for.
  */
 export async function launcher(argv = process.argv.slice(2)) {
@@ -187,10 +188,19 @@ export async function launcher(argv = process.argv.slice(2)) {
     );
   }
 
-  // Asked before this run registers itself, so it cannot find itself. Two writing runs share
-  // one worktree with no isolation: the second one's before/after snapshot picks up the
-  // first one's edits, and an honest run gets failed for work it never did.
-  const busy = opts.agent === 'codex-build' ? activeRunDetails(projectRunsRoot, repoRoot) : null;
+  // Review 2026-09-17: the slow probe widened the window between the busy check and registration.
+  // Probe first so the busy check sees writers that registered while it waited.
+  // Keep dead refusal before retention to preserve old run artifacts.
+  const sandboxProbe = await probeSandbox({ agent: opts.agent, repo: repoRoot });
+  if (sandboxProbe.outcome === 'dead') die(sandboxRefusal(sandboxProbe));
+
+  // Everything that can refuse without touching the tree is asked here, after the probe so the
+  // busy check sees writers that registered while it waited, and before makeRunDir below: on
+  // 2026-09-19 a busy refusal left its folder inside ~/.claude and the live run's witness spent
+  // every tool call demanding the orchestrator revert a directory the tool itself had created.
+  // Exit 1, not the usage code 2: the order was correct, the host or the tree was not.
+  const preflightError = preflightRefusal({ agent: opts.agent, projectRunsRoot, repoRoot });
+  if (preflightError) die(preflightError, 1);
 
   let retention = null;
   try {
@@ -204,7 +214,7 @@ export async function launcher(argv = process.argv.slice(2)) {
   const runDir = makeRunDir(runDirPath(projectRunsRoot, opts.slug));
   setRun(runDir, opts.agent);
 
-  // Written before Codex is even probed. From here on a killed runner leaves a folder that
+  // Written before the worker can start. From here on a killed runner leaves a folder that
   // says what it was and whose pid to check, instead of a folder that says nothing — the run
   // itself takes 20-25 minutes, far longer than the caller's default timeout, so being killed
   // mid-run is the normal way for this to end, not the exotic one.
@@ -221,7 +231,7 @@ export async function launcher(argv = process.argv.slice(2)) {
     slug: opts.slug,
     order_id: opts.orderId,
     // Fingerprint of the order, so a later run of the same task finds this one whatever it
-    // calls itself. Written here, before Codex is probed, like everything the chain reads.
+    // calls itself. Written here, before Codex starts, like everything the chain reads.
     task_hash: taskHash,
     repo: repoRoot,
     started_at: new Date().toISOString(),
@@ -231,30 +241,13 @@ export async function launcher(argv = process.argv.slice(2)) {
     // `continued_from` is the exact run the orchestrator named; `continues` above remains the chain base.
     ...(continuationGrant ? { continued_from: continuationGrant.run } : {}),
     ...(retention ? { retention } : {}),
+    sandbox_probe: sandboxProbe,
   });
 
   // Printed before anything can go wrong: even a dispatcher that dies mid-run leaves the
   // orchestrator with a folder to look into.
   console.log(`RUN=${runDir} order-id=${opts.orderId}`);
 
-  // Before requireCodex, so a blocked run costs nothing at all.
-  if (busy) {
-    const identityNote = busy.identity === 'unverified'
-      ? '; process identity could not be confirmed'
-      : '';
-    const { reply } = writeFailure(
-      runDir,
-      opts.agent,
-      `run ${busy.run} is already active for this repository; two writing runs in one tree are prohibited${identityNote}`,
-      [`Active run: ${path.join(projectRunsRoot, busy.run)}`, 'Codex was not started; quota was not spent'],
-      true,
-    );
-    console.log(reply);
-    return 1;
-  }
-
-  requireCodex(runDir, opts.agent);
-
   const scope = opts.agent === 'codex-review' ? reviewScope(repoRoot, opts.changeset) : null;
   if (scope) {
     fs.writeFileSync(

package/src/home/lib/runner/preflight.mjs

@@ -0,0 +1,35 @@
+/**
+ * Refusals that must not touch the tree, decided before a run is registered. On 2026-09-19,
+ * a busy-tree refusal left its own folder in the live writer's witness. This boundary knows
+ * only the project runs root and existing holders, never the prospective run's directory.
+ */
+import path from 'node:path';
+import { activeRunDetails } from '../write-meta.mjs';
+import { codexUnavailableReason } from './codex-cmd.mjs';
+
+export function preflightRefusal({ agent, projectRunsRoot, repoRoot }) {
+  // Two writing runs share one tree: the second snapshot would include the first one's edits.
+  const busy = agent === 'codex-build' ? activeRunDetails(projectRunsRoot, repoRoot) : null;
+  if (busy) {
+    const identityNote = busy.identity === 'unverified'
+      ? '; process identity could not be confirmed'
+      : '';
+    return [
+      `run ${busy.run} is already active for this repository; two writing runs in one tree are prohibited${identityNote}`,
+      `Active run: ${path.join(projectRunsRoot, busy.run)}`,
+      // One sentence, the same one every other pre-flight refusal ends with. The older wording
+      // said the identical thing twice, which is how two copies of a rule start to drift.
+      'The run folder was not created; quota was not spent.',
+    ].join('\n');
+  }
+
+  const why = codexUnavailableReason();
+  if (why !== null) {
+    return [
+      `Codex CLI unavailable: ${why}`,
+      'Operator check: codex --version (and codex login if authorization is rejected)',
+      'The run folder was not created; quota was not spent.',
+    ].join('\n');
+  }
+  return null;
+}

package/src/home/lib/runner/sandbox-probe.mjs

@@ -0,0 +1,109 @@
+/** Checks whether this host's Codex sandbox can start a process before a run spends quota. */
+import { performance } from 'node:perf_hooks';
+import { sandboxModeFor } from './codex-args.mjs';
+import { codexSpawnSpec, spawnCaptured } from './codex-cmd.mjs';
+import { platformSandboxArgs } from './sandbox-flags.mjs';
+
+export const SANDBOX_PROBE_MARKER = 'codex-bridge-sandbox-ok';
+// Plan_57 D12/D19: a platform is judged only after both outcomes were seen live. Linux joined on
+// 2026-09-17: dead on an Ubuntu 24.04 VPS (bwrap without a user namespace, exit 1, no marker), alive
+// on the same host after the AppArmor repair. macOS has never been observed.
+export const PROBED_PLATFORMS = new Set(['win32', 'linux']);
+
+// Ubuntu 23.10+ forbids unprivileged user namespaces unless an AppArmor profile allows bwrap; that
+// is the ordinary state of a fresh server, not an accident like the corrupted Windows state file.
+const LINUX_REPAIR = [
+  'On Ubuntu 23.10 and later this usually means AppArmor does not let bubblewrap create a user namespace.',
+  'Official repair: https://learn.chatgpt.com/docs/sandboxing — the bwrap-userns-restrict AppArmor profile',
+  '(Ubuntu 24.04) or the bubblewrap package (25.04 and later). Do not set',
+  'kernel.apparmor_restrict_unprivileged_userns=0: it lifts the restriction for every program on the host.',
+].join(' ');
+
+const echoArgs = (platform) => platform === 'win32'
+  ? ['cmd', '/d', '/c', 'echo', SANDBOX_PROBE_MARKER]
+  : ['echo', SANDBOX_PROBE_MARKER];
+
+function inconclusiveReason(result, form) {
+  if (result.error) {
+    return result.error.code === 'ETIMEDOUT'
+      ? `The ${form} sandbox probe timed out.`
+      : `The ${form} sandbox probe could not start or complete.`;
+  }
+  if (result.signal) return `The ${form} sandbox probe was terminated by ${result.signal}.`;
+  if (result.status === 2) return `Codex rejected the ${form} sandbox probe arguments.`;
+  if (result.status == null) return `The ${form} sandbox probe returned no exit status.`;
+  return null;
+}
+
+export async function probeSandbox({
+  agent, repo, platform = process.platform, run = spawnCaptured, timeoutMs = 30_000,
+}) {
+  if (!PROBED_PLATFORMS.has(platform)) return { outcome: 'skipped' };
+  const sandbox = sandboxModeFor(agent);
+  if (typeof repo !== 'string' || !repo) throw new Error('sandbox probe requires a repository path');
+  const echo = echoArgs(platform);
+  const attempts = [];
+  const finish = (outcome, reason) => ({ outcome, reason, attempts });
+  const attempt = async (form, args) => {
+    const spec = codexSpawnSpec(args, platform);
+    const started = performance.now();
+    const result = await run(spec.command, spec.args, {
+      ...spec.options, cwd: repo, encoding: 'utf8', timeout: timeoutMs,
+    });
+    const marker = String(result.stdout ?? '').includes(SANDBOX_PROBE_MARKER);
+    attempts.push({
+      form, status: result.status ?? null, marker,
+      ms: Math.round(performance.now() - started),
+      // D2: stderr is evidence for the operator, never input to the verdict.
+      stderrTail: String(result.stderr ?? '').slice(-300),
+    });
+    return { ...result, marker };
+  };
+
+  // On 2026-09-16 a corrupt deny_read_acl_state.json made every paid run unable to start tools.
+  // On 2026-09-17, -C required --permission-profile instead: cwd must be a process option.
+  // D16: no single failure exit code proves a dead sandbox; both forms and a live CLI must agree.
+  const flagged = await attempt('flagged', [
+    'sandbox', ...platformSandboxArgs(platform), '-c', `sandbox_mode=${sandbox}`, '--', ...echo,
+  ]);
+  const flaggedReason = inconclusiveReason(flagged, 'flagged');
+  if (flaggedReason) return finish('inconclusive', flaggedReason);
+  if (flagged.status === 0 && flagged.marker) {
+    return finish('alive', 'The Codex sandbox started a process.');
+  }
+  // D16: the marker proves a process started, so a nonzero exit cannot prove a dead sandbox.
+  if (flagged.marker) {
+    return finish('inconclusive', `The flagged sandbox probe printed the marker but exited ${flagged.status}.`);
+  }
+
+  const control = await attempt('control', ['sandbox', '--', ...echo]);
+  const controlReason = inconclusiveReason(control, 'control');
+  if (controlReason) return finish('inconclusive', controlReason);
+  if (control.marker) {
+    return finish('inconclusive', 'This version of Codex no longer accepts the package sandbox flags.');
+  }
+
+  const version = await attempt('version', ['--version']);
+  if (version.error || version.signal || version.status !== 0) {
+    // codexUnavailableReason() owns the refusal for an unavailable CLI, in the same pre-flight pass.
+    return finish('inconclusive', 'Codex CLI is unavailable.');
+  }
+  return finish('dead', 'The Codex sandbox on this host cannot start a process.');
+}
+
+export function sandboxRefusal(result, platform = process.platform) {
+  const control = ['codex', 'sandbox', '--', ...echoArgs(platform)].join(' ');
+  const stderr = result.attempts
+    .filter(({ form }) => form === 'flagged' || form === 'control')
+    .map(({ form, stderrTail }) =>
+      `${form} stderr:\n> ${(stderrTail || '(empty)').replace(/\r\n?/g, '\n').replace(/\n/g, '\n> ')}`);
+  // Only a dead result is refused, and its reason already is the headline; printing both said it twice.
+  return [
+    result.reason,
+    'Repair the host sandbox; do not rewrite or retry the order.',
+    ...(platform === 'linux' ? [LINUX_REPAIR] : []),
+    `Operator check (run from the repository directory): ${control}`,
+    ...stderr,
+    'The run folder was not created; quota was not spent.',
+  ].join('\n\n');
+}

package/src/home/lib/runner/scope-check.mjs

@@ -24,7 +24,7 @@ function absolutePattern(pattern) {
   );
 }
 
-function structuralRefusal(pattern) {
+function structuralRefusal(repoRoot, pattern) {
   if (absolutePattern(pattern)) {
     return {
       reason: 'is an absolute or drive-qualified path',
@@ -43,6 +43,26 @@ function structuralRefusal(pattern) {
       action: 'remove the .. segment and keep the path relative to the repository root',
     };
   }
+  // Plan_58 D7: 2026-09-19_191402_ports-infra spent a run on a bare scope-new directory,
+  // which the verdict could only match as a file. Refuse that intent before spending a run.
+  if (!pattern || /[*?]/.test(pattern)) return null;
+  const reason = 'names a directory rather than a file';
+  const action = `write ${pattern.replace(/\/$/, '')}/** for everything inside it, or name the file itself`;
+  if (pattern.endsWith('/')) return { reason, action };
+
+  let entry;
+  try {
+    entry = fs.statSync(path.join(repoRoot, pattern));
+  } catch {
+    // An unreadable or vanished path is treated as missing, so only its spelling is checked.
+  }
+  if (entry?.isDirectory()) return { reason, action };
+  if (!entry && !pattern.split('/').at(-1).includes('.')) {
+    return {
+      reason,
+      action: `write ${pattern}/** if it is a directory, or declare the new file by its own name with an extension; a new extensionless file is declared through its directory`,
+    };
+  }
   return null;
 }
 
@@ -133,7 +153,7 @@ export function validateScope(repoRoot, patterns, scopeNewPatterns = []) {
   const allPatterns = [...declared, ...newPaths];
 
   for (const pattern of allPatterns) {
-    const refusal = structuralRefusal(pattern);
+    const refusal = structuralRefusal(repoRoot, pattern);
     if (refusal) return { pattern, ...refusal };
     if (!pattern) return noMatchRefusal(pattern);
   }

package/src/home/lib/write-meta.mjs

@@ -29,6 +29,7 @@ import { readEvents } from './meta/events.mjs';
 import { writeStatus } from './meta/run-state.mjs';
 import { resolveStatus } from './meta/verdict.mjs';
 import { AGENTS, failReply, limitReply, withProfileRow } from './meta/reply.mjs';
+import { withLaunchRows } from './meta/launch-rows.mjs';
 
 function readRunnerVersion() {
   try {
@@ -149,7 +150,10 @@ export function collect(runDir, agent, exitCode) {
   };
   const reply =
     withProfileRow(
-      status === 'OK' ? cfg.reply(ctx) : status === 'LIMIT' ? limitReply(ctx, meta) : failReply(ctx, meta),
+      withLaunchRows(
+        status === 'OK' ? cfg.reply(ctx) : status === 'LIMIT' ? limitReply(ctx, meta) : failReply(ctx, meta),
+        runDir,
+      ),
       meta,
     );