@mindexec/cli 0.2.43 → 0.2.45

package/codex-runtime.js

@@ -1,5 +1,6 @@
 import { promises as fs, readFileSync } from 'fs';
 import path from 'path';
+import os from 'os';
 import { exec, spawn } from 'child_process';
 import { promisify } from 'util';
 import crypto from 'crypto';
@@ -36,6 +37,7 @@ const DEFAULT_TIMEOUT_MS = 8 * 60 * 1000;
 const MAX_LOG_CHARS = 4000;
 const MAX_EVENT_LOG = 120;
 const TEMP_DIR = '.ai/codex';
+const CODEX_CONFIG_PATH = path.join(os.homedir(), '.codex', 'config.toml');
 
 let cachedSdkModule = null;
 let cachedSdkLoadError = null;
@@ -88,6 +90,75 @@ function normalizeProviderKind(value) {
     return '';
 }
 
+function isEnabledEnv(value) {
+    return /^(1|true|yes|on)$/i.test(String(value || '').trim());
+}
+
+function unquoteTomlKey(value) {
+    const text = String(value || '').trim();
+    if (text.length >= 2 && ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'")))) {
+        return text.slice(1, -1).replace(/\\(["\\])/g, '$1').trim();
+    }
+
+    return text;
+}
+
+function readConfiguredMcpServerNames() {
+    if (isEnabledEnv(process.env.MINDEXEC_CODEX_INHERIT_MCP)) {
+        return [];
+    }
+
+    const names = new Set();
+    try {
+        const content = readFileSync(CODEX_CONFIG_PATH, 'utf8');
+        for (const rawLine of content.split(/\r?\n/)) {
+            const line = rawLine.trim();
+            const match = line.match(/^\[mcp_servers\.((?:"(?:[^"\\]|\\.)+"|'(?:[^'\\]|\\.)+'|[^\]\s]+))\]$/);
+            if (!match) {
+                continue;
+            }
+
+            const name = unquoteTomlKey(match[1]);
+            if (/^[A-Za-z0-9_-]+$/.test(name)) {
+                names.add(name);
+            }
+        }
+    } catch {
+        // Missing Codex config is fine; SDK auth still reports its own error if login is required.
+    }
+
+    for (const name of String(process.env.MINDEXEC_CODEX_DISABLED_MCP_SERVERS || 'cloudflare,supabase')
+        .split(',')
+        .map(item => item.trim())
+        .filter(Boolean)) {
+        if (/^[A-Za-z0-9_-]+$/.test(name)) {
+            names.add(name);
+        }
+    }
+
+    return Array.from(names).sort();
+}
+
+function buildCodexSdkConfigOverrides() {
+    const mcpServerNames = readConfiguredMcpServerNames();
+    if (mcpServerNames.length === 0) {
+        return {};
+    }
+
+    const mcpServers = {};
+    for (const name of mcpServerNames) {
+        mcpServers[name] = { enabled: false };
+    }
+
+    return { mcp_servers: mcpServers };
+}
+
+function appendCodexIsolationConfigArgs(args) {
+    for (const name of readConfiguredMcpServerNames()) {
+        args.push('--config', `mcp_servers.${name}.enabled=false`);
+    }
+}
+
 function normalizeReasoningEffort(value) {
     const normalized = String(value || '').trim().toLowerCase();
     return ['minimal', 'low', 'medium', 'high', 'xhigh'].includes(normalized)
@@ -491,7 +562,7 @@ export function createCodexRuntime(options) {
 
         if (providerKind === PROVIDER_KIND.typeScriptSdk) {
             const sdk = await loadCodexSdk();
-            const codex = new sdk.Codex();
+            const codex = new sdk.Codex({ config: buildCodexSdkConfigOverrides() });
             const thread = codex.startThread(threadOptions);
             const localThreadId = `local_${crypto.randomUUID()}`;
             threads.set(localThreadId, {
@@ -553,7 +624,7 @@ export function createCodexRuntime(options) {
         }
 
         const sdk = await loadCodexSdk();
-        const codex = new sdk.Codex();
+        const codex = new sdk.Codex({ config: buildCodexSdkConfigOverrides() });
         const officialId = requestedThreadId && !requestedThreadId.startsWith('local_')
             ? requestedThreadId
             : '';
@@ -708,6 +779,7 @@ export function createCodexRuntime(options) {
             '--config',
             `model_reasoning_effort=${threadOptions.modelReasoningEffort}`
         ];
+        appendCodexIsolationConfigArgs(args);
 
         if (threadOptions.model) {
             args.push('-m', threadOptions.model);
@@ -863,7 +935,7 @@ export function createCodexRuntime(options) {
             const workingDirectory = await resolveWorkingDirectory(body.workingDir || body.workingDirectory || '');
             const threadOptions = buildThreadOptions(body, workingDirectory);
             const sdk = await loadCodexSdk();
-            const codex = new sdk.Codex();
+            const codex = new sdk.Codex({ config: buildCodexSdkConfigOverrides() });
             const thread = codex.resumeThread(threadId, threadOptions);
             threads.set(threadId, {
                 providerKind,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.43",
+  "version": "0.2.45",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",