@ornexus/neocortex 4.60.68 → 4.60.69

package/packages/client/dist/private-execution/codex-host-runtime.js

@@ -1,137 +1 @@
-import { startPrivateCodexHomeGuard } from './codex-lifecycle-guard.js';
-/** Host control state for one subscription execution. Never a QA checkout or image. */
-import { createHash } from 'node:crypto';
-import { closeSync, constants, fstatSync, lstatSync, mkdtempSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { isAbsolute, join, relative } from 'node:path';
-const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
-const liveRuntimes = new Set();
-let exitCleanupInstalled = false;
-function fail() { throw new Error('private-codex-host-runtime-unverified'); }
-function readFile(path, credential) {
-    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-    try {
-        const before = fstatSync(fd);
-        if (!before.isFile() || before.uid !== process.getuid?.() || before.nlink !== 1
-            || before.mode & 0o022 || credential && (before.mode & 0o777) !== 0o600
-            || before.size < 1 || before.size > 1048576)
-            fail();
-        const bytes = readFileSync(fd), after = fstatSync(fd), current = lstatSync(path);
-        if (bytes.length !== before.size || [after, current].some(s => s.dev !== before.dev || s.ino !== before.ino
-            || s.size !== before.size || s.mtimeMs !== before.mtimeMs || s.ctimeMs !== before.ctimeMs
-            || s.mode !== before.mode || s.nlink !== 1))
-            fail();
-        return bytes;
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-/** The CLI may record project trust in its own configuration. Keep that write in
- * short-lived, owner-private host control storage using the existing account.
- * No credential is placed in, mounted into or passed to the model checkout. */
-export function createPrivateCodexHostRuntime(projectRoot, sourceHome) {
-    try {
-        const root = realpathSync(projectRoot), source = realpathSync(sourceHome), relation = relative(root, source);
-        const parent = lstatSync(source);
-        if (!relation || !relation.startsWith('..') && !isAbsolute(relation)
-            || !parent.isDirectory() || parent.uid !== process.getuid?.() || parent.mode & 0o022)
-            fail();
-        const auth = readFile(join(source, 'auth.json'), true);
-        let config;
-        try {
-            config = readFile(join(source, 'config.toml'), false);
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                throw error;
-        }
-        const authDigest = digest(auth), configDigest = config ? digest(config) : undefined;
-        const home = mkdtempSync(join(source, '.neocortex-executor-')), identity = lstatSync(home);
-        const guard = process.platform === 'linux' ? startPrivateCodexHomeGuard(home) : undefined;
-        let closed = false;
-        const custody = () => {
-            const current = lstatSync(home), directory = lstatSync(source);
-            if (realpathSync(source) !== source || directory.dev !== parent.dev || directory.ino !== parent.ino
-                || directory.uid !== parent.uid || directory.mode & 0o022 || current.dev !== identity.dev || current.ino !== identity.ino
-                || current.uid !== process.getuid?.() || (current.mode & 0o777) !== 0o700 || !current.isDirectory()
-                || current.isSymbolicLink())
-                fail();
-        };
-        let runtime;
-        const close = () => {
-            if (closed)
-                return;
-            try {
-                custody();
-                rmSync(home, { recursive: true });
-                closed = true;
-                if (runtime)
-                    liveRuntimes.delete(runtime);
-                if (guard?.connected)
-                    guard.disconnect();
-            }
-            catch {
-                fail();
-            }
-        };
-        try {
-            writeFileSync(join(home, 'auth.json'), auth, { mode: 0o600, flag: 'wx' });
-            if (config)
-                writeFileSync(join(home, 'config.toml'), config, { mode: 0o600, flag: 'wx' });
-            auth.fill(0);
-            config?.fill(0);
-            const verify = () => {
-                try {
-                    if (closed || guard && (!guard.connected || guard.exitCode !== null || guard.signalCode !== null))
-                        fail();
-                    custody();
-                    if (digest(readFile(join(source, 'auth.json'), true)) !== authDigest)
-                        fail();
-                    let current;
-                    try {
-                        current = readFile(join(source, 'config.toml'), false);
-                    }
-                    catch (error) {
-                        if (error.code !== 'ENOENT')
-                            throw error;
-                    }
-                    if ((current ? digest(current) : undefined) !== configDigest)
-                        fail();
-                    readFile(join(home, 'auth.json'), true);
-                    try {
-                        readFile(join(home, 'config.toml'), true);
-                    }
-                    catch (error) {
-                        if (error.code !== 'ENOENT')
-                            throw error;
-                    }
-                }
-                catch {
-                    fail();
-                }
-            };
-            verify();
-            runtime = Object.freeze({ home, sourceHome: source, verify, close });
-            liveRuntimes.add(runtime);
-            if (!exitCleanupInstalled) {
-                exitCleanupInstalled = true;
-                process.once('exit', () => {
-                    for (const pending of liveRuntimes) {
-                        try {
-                            pending.close();
-                        }
-                        catch { /* Preserve a directory whose custody became ambiguous. */ }
-                    }
-                });
-            }
-            return runtime;
-        }
-        catch (error) {
-            close();
-            throw error;
-        }
-    }
-    catch {
-        fail();
-    }
-}
+import{startPrivateCodexHomeGuard as L}from"./codex-lifecycle-guard.js";import{createHash as k}from"node:crypto";import{closeSync as H,constants as O,fstatSync as z,lstatSync as g,mkdtempSync as M,openSync as R,readFileSync as T,realpathSync as S,rmSync as _,writeFileSync as C}from"node:fs";import{isAbsolute as P,join as c,relative as W}from"node:path";const p=d=>k("sha256").update(d).digest("hex"),w=new Set;let b=!1;function r(){throw new Error("private-codex-host-runtime-unverified")}function a(d,v){const f=R(d,O.O_RDONLY|O.O_NOFOLLOW|O.O_NONBLOCK);try{const e=z(f);(!e.isFile()||e.uid!==process.getuid?.()||e.nlink!==1||e.mode&18||v&&(e.mode&511)!==384||e.size<1||e.size>1048576)&&r();const l=T(f),s=z(f),m=g(d);return(l.length!==e.size||[s,m].some(t=>t.dev!==e.dev||t.ino!==e.ino||t.size!==e.size||t.mtimeMs!==e.mtimeMs||t.ctimeMs!==e.ctimeMs||t.mode!==e.mode||t.nlink!==1))&&r(),l}finally{H(f)}}function K(d,v){try{const f=S(d),e=S(v),l=W(f,e),s=g(e);(!l||!l.startsWith("..")&&!P(l)||!s.isDirectory()||s.uid!==process.getuid?.()||s.mode&18)&&r();const m=a(c(e,"auth.json"),!0);let t;try{t=a(c(e,"config.toml"),!1)}catch(o){if(o.code!=="ENOENT")throw o}const D=p(m),F=t?p(t):void 0,n=M(c(e,".neocortex-executor-")),N=g(n),u=process.platform==="linux"?L(n):void 0;let x=!1;const E=()=>{const o=g(n),i=g(e);(S(e)!==e||i.dev!==s.dev||i.ino!==s.ino||i.uid!==s.uid||i.mode&18||o.dev!==N.dev||o.ino!==N.ino||o.uid!==process.getuid?.()||(o.mode&511)!==448||!o.isDirectory()||o.isSymbolicLink())&&r()};let y;const j=()=>{if(!x)try{E(),_(n,{recursive:!0}),x=!0,y&&w.delete(y),u?.connected&&u.disconnect()}catch{r()}};try{C(c(n,"auth.json"),m,{mode:384,flag:"wx"}),t&&C(c(n,"config.toml"),t,{mode:384,flag:"wx"}),m.fill(0),t?.fill(0);const o=()=>{try{(x||u&&(!u.connected||u.exitCode!==null||u.signalCode!==null))&&r(),E(),p(a(c(e,"auth.json"),!0))!==D&&r();let i;try{i=a(c(e,"config.toml"),!1)}catch(h){if(h.code!=="ENOENT")throw h}(i?p(i):void 0)!==F&&r(),a(c(n,"auth.json"),!0);try{a(c(n,"config.toml"),!0)}catch(h){if(h.code!=="ENOENT")throw h}}catch{r()}};return o(),y=Object.freeze({home:n,sourceHome:e,verify:o,close:j}),w.add(y),b||(b=!0,process.once("exit",()=>{for(const i of w)try{i.close()}catch{}})),y}catch(o){throw j(),o}}catch{r()}}export{K as createPrivateCodexHostRuntime};

package/packages/client/dist/private-execution/codex-lifecycle-guard.js

@@ -1,97 +1 @@
-/** Mechanical Linux process/custody lifetime; no workflow material or authority. */
-import { spawn } from 'node:child_process';
-import { lstatSync, realpathSync, rmSync } from 'node:fs';
-import { basename } from 'node:path';
-import { fileURLToPath } from 'node:url';
-// Source-driven development tests launch the same compiled helper as the CLI.
-export const codexLifecycleGuardPath = fileURLToPath(new URL(import.meta.url.endsWith('.ts')
-    ? '../../dist/private-execution/codex-lifecycle-guard.js' : './codex-lifecycle-guard.js', import.meta.url));
-export function startPrivateCodexHomeGuard(home) {
-    const identity = lstatSync(home);
-    const guard = spawn(process.execPath, [codexLifecycleGuardPath, 'home', home, String(identity.dev), String(identity.ino)], {
-        detached: true, env: {}, stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
-    });
-    // A failed guard is observed by runtime.verify(); never print host paths.
-    guard.on('error', () => undefined);
-    guard.unref();
-    guard.channel?.unref();
-    return guard;
-}
-function stopOwnGroup() {
-    // This process remains the group leader until this syscall: no stale PID kill.
-    process.kill(-process.pid, 'SIGKILL');
-    process.exit(1);
-}
-function homeGuard() {
-    const [home, dev, ino] = process.argv.slice(3);
-    let handled = false;
-    const close = () => {
-        if (handled)
-            return;
-        handled = true;
-        try {
-            if (!home || !basename(home).startsWith('.neocortex-executor-'))
-                throw new Error();
-            const identity = lstatSync(home);
-            if (realpathSync(home) !== home || !identity.isDirectory() || identity.isSymbolicLink()
-                || identity.uid !== process.getuid?.() || (identity.mode & 0o777) !== 0o700
-                || String(identity.dev) !== dev || String(identity.ino) !== ino)
-                throw new Error();
-            rmSync(home, { recursive: true });
-            process.exit(0);
-        }
-        catch (error) {
-            // Missing means the root already closed it. Ambiguous custody is retained.
-            process.exit(error.code === 'ENOENT' ? 0 : 1);
-        }
-    };
-    process.on('disconnect', close);
-    if (!process.connected)
-        close();
-}
-function processGuard() {
-    process.on('disconnect', stopOwnGroup);
-    process.on('SIGTERM', stopOwnGroup);
-    process.on('SIGINT', stopOwnGroup);
-    process.stdout.on('error', stopOwnGroup);
-    process.stderr.on('error', stopOwnGroup);
-    if (!process.connected)
-        stopOwnGroup();
-    process.once('message', (value) => {
-        const input = value;
-        if (!input || input.kind !== 'private-codex-launch' || !Array.isArray(input.args)
-            || input.args.some(arg => typeof arg !== 'string')
-            || input.codexHome !== undefined && typeof input.codexHome !== 'string')
-            stopOwnGroup();
-        const args = input.args;
-        const child = spawn(input.codexHome === undefined ? 'codex' : '/bin/sh', input.codexHome === undefined
-            ? args : ['-c', 'umask 077; exec codex "$@"', 'neocortex-private-codex', ...args], {
-            cwd: process.cwd(), env: Object.fromEntries(['PATH', 'HOME', 'LANG', 'LC_ALL', 'TERM', 'CODEX_HOME']
-                .filter(key => process.env[key] !== undefined).map(key => [key, process.env[key]])),
-            detached: false, stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        process.stdin.pipe(child.stdin);
-        child.stdin.on('error', () => undefined);
-        child.stdout.pipe(process.stdout);
-        child.stderr.pipe(process.stderr);
-        child.on('error', stopOwnGroup);
-        child.on('close', code => {
-            // close waits for inherited pipes, retaining this live group anchor.
-            process.stdin.unpipe(child.stdin);
-            process.stdin.pause();
-            process.removeListener('disconnect', stopOwnGroup);
-            if (process.connected)
-                process.disconnect?.();
-            // Natural exit drains forwarded stdout/stderr before the root reads close.
-            process.exitCode = typeof code === 'number' ? code : 1;
-        });
-    });
-}
-if (process.argv[1] === codexLifecycleGuardPath && process.platform === 'linux') {
-    if (process.argv[2] === 'home')
-        homeGuard();
-    else if (process.argv[2] === 'process')
-        processGuard();
-    else
-        process.exit(1);
-}
+import{spawn as i}from"node:child_process";import{lstatSync as d,realpathSync as a,rmSync as u}from"node:fs";import{basename as f}from"node:path";import{fileURLToPath as m}from"node:url";const p=m(new URL(import.meta.url.endsWith(".ts")?"../../dist/private-execution/codex-lifecycle-guard.js":"./codex-lifecycle-guard.js",import.meta.url));function L(r){const e=d(r),c=i(process.execPath,[p,"home",r,String(e.dev),String(e.ino)],{detached:!0,env:{},stdio:["ignore","ignore","ignore","ipc"]});return c.on("error",()=>{}),c.unref(),c.channel?.unref(),c}function n(){process.kill(-process.pid,"SIGKILL"),process.exit(1)}function l(){const[r,e,c]=process.argv.slice(3);let s=!1;const o=()=>{if(!s){s=!0;try{if(!r||!f(r).startsWith(".neocortex-executor-"))throw new Error;const t=d(r);if(a(r)!==r||!t.isDirectory()||t.isSymbolicLink()||t.uid!==process.getuid?.()||(t.mode&511)!==448||String(t.dev)!==e||String(t.ino)!==c)throw new Error;u(r,{recursive:!0}),process.exit(0)}catch(t){process.exit(t.code==="ENOENT"?0:1)}}};process.on("disconnect",o),process.connected||o()}function x(){process.on("disconnect",n),process.on("SIGTERM",n),process.on("SIGINT",n),process.stdout.on("error",n),process.stderr.on("error",n),process.connected||n(),process.once("message",r=>{const e=r;(!e||e.kind!=="private-codex-launch"||!Array.isArray(e.args)||e.args.some(o=>typeof o!="string")||e.codexHome!==void 0&&typeof e.codexHome!="string")&&n();const c=e.args,s=i(e.codexHome===void 0?"codex":"/bin/sh",e.codexHome===void 0?c:["-c",'umask 077; exec codex "$@"',"neocortex-private-codex",...c],{cwd:process.cwd(),env:Object.fromEntries(["PATH","HOME","LANG","LC_ALL","TERM","CODEX_HOME"].filter(o=>process.env[o]!==void 0).map(o=>[o,process.env[o]])),detached:!1,stdio:["pipe","pipe","pipe"]});process.stdin.pipe(s.stdin),s.stdin.on("error",()=>{}),s.stdout.pipe(process.stdout),s.stderr.pipe(process.stderr),s.on("error",n),s.on("close",o=>{process.stdin.unpipe(s.stdin),process.stdin.pause(),process.removeListener("disconnect",n),process.connected&&process.disconnect?.(),process.exitCode=typeof o=="number"?o:1})})}process.argv[1]===p&&process.platform==="linux"&&(process.argv[2]==="home"?l():process.argv[2]==="process"?x():process.exit(1));export{p as codexLifecycleGuardPath,L as startPrivateCodexHomeGuard};

package/packages/client/dist/private-execution/codex-scoped-permissions.js

@@ -1,128 +1 @@
-import { randomBytes } from 'node:crypto';
-import { accessSync, constants, lstatSync, readdirSync, realpathSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { createRequire } from 'node:module';
-import { basename, delimiter, dirname, join, resolve, sep } from 'node:path';
-import { gitLifecycleRuntimeDirectory } from '../git/git-lifecycle-store.js';
-/** SDK state shares the Git control directory but is not model-readable Git metadata. */
-function rootOwnedGitStores(directories) {
-    const paths = new Set();
-    for (const directory of directories) {
-        const control = lstatSync(directory);
-        if (!control.isDirectory() || control.isSymbolicLink() || realpathSync(directory) !== directory) {
-            throw new Error('private-codex-root-state-isolation-unproven');
-        }
-        for (const name of readdirSync(directory)) {
-            if (!name.startsWith('neocortex-'))
-                continue;
-            const path = join(directory, name), entry = lstatSync(path);
-            if (!/^[A-Za-z0-9._-]{1,128}$/.test(name) || entry.isSymbolicLink()
-                || !entry.isDirectory() && !entry.isFile())
-                throw new Error('private-codex-root-state-isolation-unproven');
-            paths.add(path);
-            if (paths.size > 64)
-                throw new Error('private-codex-root-state-isolation-unproven');
-        }
-    }
-    return [...paths].sort();
-}
-function executableReadRoots() {
-    for (const directory of (process.env.PATH ?? '').split(delimiter).filter(Boolean)) {
-        try {
-            const executable = realpathSync(join(directory, 'codex'));
-            accessSync(executable, constants.X_OK);
-            if (!lstatSync(executable).isFile())
-                continue;
-            if (basename(executable) !== 'codex.js' || basename(dirname(executable)) !== 'bin')
-                return [dirname(executable)];
-            const roots = [dirname(dirname(executable))];
-            const platformPackage = process.arch === 'x64' ? '@openai/codex-linux-x64'
-                : process.arch === 'arm64' ? '@openai/codex-linux-arm64' : undefined;
-            if (platformPackage) {
-                try {
-                    roots.push(realpathSync(dirname(createRequire(executable).resolve(`${platformPackage}/package.json`))));
-                }
-                catch { /* Older installations keep the native executable in the CLI package. */ }
-            }
-            return [...new Set(roots)];
-        }
-        catch { /* Continue searching the same executable path used by spawn. */ }
-    }
-    throw new Error('private-codex-version-unavailable');
-}
-/** Per-invocation permissions; never modifies the operator's configuration. */
-export async function createPrivateCodexScopedRunner(projectRoot, base, options) {
-    const root = realpathSync(resolve(projectRoot));
-    const controlDirectories = Object.freeze([...options.gitControlDirectories]);
-    const userHome = options.userHome ?? homedir();
-    const codexHome = options.codexHome ?? process.env.CODEX_HOME ?? join(userHome, '.codex');
-    const binaryRoots = executableReadRoots();
-    if (binaryRoots.some((path) => [sep, resolve(userHome), resolve(codexHome), root].includes(path)
-        || path.startsWith(root + sep)))
-        throw new Error('private-codex-executable-scope-unsafe');
-    const lifecycle = await gitLifecycleRuntimeDirectory(root);
-    const stores = rootOwnedGitStores(controlDirectories);
-    const filesystem = {
-        ':root': 'deny', ':minimal': 'read', [root]: 'write',
-        [join(userHome, '.ssh')]: 'deny', [join(codexHome, 'auth.json')]: 'deny',
-    };
-    if (options.credentialSourceHome) {
-        const sourceHome = resolve(options.credentialSourceHome), privateHome = resolve(codexHome);
-        filesystem[sourceHome] = 'deny';
-        if (privateHome !== sourceHome && !privateHome.startsWith(sourceHome + sep))
-            filesystem[privateHome] = 'deny';
-        // A denied ancestor covers the credential file. A second bind beneath an
-        // already denied directory cannot be created by the Linux sandbox.
-        delete filesystem[join(codexHome, 'auth.json')];
-    }
-    for (const directory of binaryRoots)
-        filesystem[directory] = 'read';
-    for (const directory of controlDirectories)
-        filesystem[directory] = 'read';
-    // Linked worktrees also have a .git control file inside the writable checkout.
-    filesystem[join(root, '.git')] = 'read';
-    filesystem[lifecycle] = 'deny';
-    for (const path of stores)
-        filesystem[path] = 'deny';
-    const profile = `p222-isolated-${randomBytes(16).toString('hex')}`;
-    const configuration = `permissions.${profile}={filesystem={${Object.entries(filesystem)
-        .map(([path, mode]) => `${JSON.stringify(path)}=${JSON.stringify(mode)}`).join(',')}},network={enabled=false}}`;
-    return async (args, runOptions) => {
-        if (realpathSync(resolve(runOptions.cwd)) !== root)
-            throw new Error('private-codex-execution-root-drift');
-        if (JSON.stringify(rootOwnedGitStores(controlDirectories)) !== JSON.stringify(stores)) {
-            throw new Error('private-codex-root-state-isolation-unproven');
-        }
-        if (args[0] !== 'sandbox' && args[0] !== 'exec')
-            return base(args, runOptions);
-        const scoped = [...args];
-        if (args[0] === 'sandbox') {
-            if (args[1] !== '-P' || args[2] !== 'p222-isolated')
-                throw new Error('private-codex-permission-profile-invalid');
-            scoped[2] = profile;
-        }
-        else {
-            const index = scoped.findIndex((arg, i) => arg === 'default_permissions="p222-isolated"' && scoped[i - 1] === '-c');
-            if (index < 0)
-                throw new Error('private-codex-permission-profile-invalid');
-            scoped[index] = `default_permissions="${profile}"`;
-            // Prove every currently registered private SDK store is unreadable at
-            // the material boundary. Probes receive no model material on stdin.
-            for (const path of stores) {
-                const probe = await base(['-c', configuration, 'sandbox', '-P', profile,
-                    '--', 'sh', '-c', 'test ! -r "$1"', 'sh', path], {
-                    cwd: root, timeoutMs: 10000, maxOutputBytes: 16384,
-                });
-                if (probe.exitCode !== 0 || probe.timedOut || probe.outputExceeded
-                    || JSON.stringify(rootOwnedGitStores(controlDirectories)) !== JSON.stringify(stores)) {
-                    throw new Error('private-codex-root-state-isolation-unproven');
-                }
-            }
-        }
-        // exec owns its own -c parser. Keep the profile in the same override set
-        // as default_permissions; a root-level override can be shadowed there.
-        return base(args[0] === 'exec'
-            ? ['exec', '-c', configuration, ...scoped.slice(1)]
-            : ['-c', configuration, ...scoped], runOptions);
-    };
-}
+import{randomBytes as g}from"node:crypto";import{accessSync as D,constants as J,lstatSync as S,readdirSync as N,realpathSync as u}from"node:fs";import{homedir as R}from"node:os";import{createRequire as k}from"node:module";import{basename as $,delimiter as P,dirname as x,join as a,resolve as l,sep as b}from"node:path";import{gitLifecycleRuntimeDirectory as _}from"../git/git-lifecycle-store.js";function E(p){const o=new Set;for(const t of p){const r=S(t);if(!r.isDirectory()||r.isSymbolicLink()||u(t)!==t)throw new Error("private-codex-root-state-isolation-unproven");for(const s of N(t)){if(!s.startsWith("neocortex-"))continue;const d=a(t,s),c=S(d);if(!/^[A-Za-z0-9._-]{1,128}$/.test(s)||c.isSymbolicLink()||!c.isDirectory()&&!c.isFile())throw new Error("private-codex-root-state-isolation-unproven");if(o.add(d),o.size>64)throw new Error("private-codex-root-state-isolation-unproven")}}return[...o].sort()}function C(){for(const p of(process.env.PATH??"").split(P).filter(Boolean))try{const o=u(a(p,"codex"));if(D(o,J.X_OK),!S(o).isFile())continue;if($(o)!=="codex.js"||$(x(o))!=="bin")return[x(o)];const t=[x(x(o))],r=process.arch==="x64"?"@openai/codex-linux-x64":process.arch==="arm64"?"@openai/codex-linux-arm64":void 0;if(r)try{t.push(u(x(k(o).resolve(`${r}/package.json`))))}catch{}return[...new Set(t)]}catch{}throw new Error("private-codex-version-unavailable")}async function M(p,o,t){const r=u(l(p)),s=Object.freeze([...t.gitControlDirectories]),d=t.userHome??R(),c=t.codexHome??process.env.CODEX_HOME??a(d,".codex"),O=C();if(O.some(e=>[b,l(d),l(c),r].includes(e)||e.startsWith(r+b)))throw new Error("private-codex-executable-scope-unsafe");const j=await _(r),y=E(s),i={":root":"deny",":minimal":"read",[r]:"write",[a(d,".ssh")]:"deny",[a(c,"auth.json")]:"deny"};if(t.credentialSourceHome){const e=l(t.credentialSourceHome),n=l(c);i[e]="deny",n!==e&&!n.startsWith(e+b)&&(i[n]="deny"),delete i[a(c,"auth.json")]}for(const e of O)i[e]="read";for(const e of s)i[e]="read";i[a(r,".git")]="read",i[j]="deny";for(const e of y)i[e]="deny";const h=`p222-isolated-${g(16).toString("hex")}`,w=`permissions.${h}={filesystem={${Object.entries(i).map(([e,n])=>`${JSON.stringify(e)}=${JSON.stringify(n)}`).join(",")}},network={enabled=false}}`;return async(e,n)=>{if(u(l(n.cwd))!==r)throw new Error("private-codex-execution-root-drift");if(JSON.stringify(E(s))!==JSON.stringify(y))throw new Error("private-codex-root-state-isolation-unproven");if(e[0]!=="sandbox"&&e[0]!=="exec")return o(e,n);const f=[...e];if(e[0]==="sandbox"){if(e[1]!=="-P"||e[2]!=="p222-isolated")throw new Error("private-codex-permission-profile-invalid");f[2]=h}else{const H=f.findIndex((v,m)=>v==='default_permissions="p222-isolated"'&&f[m-1]==="-c");if(H<0)throw new Error("private-codex-permission-profile-invalid");f[H]=`default_permissions="${h}"`;for(const v of y){const m=await o(["-c",w,"sandbox","-P",h,"--","sh","-c",'test ! -r "$1"',"sh",v],{cwd:r,timeoutMs:1e4,maxOutputBytes:16384});if(m.exitCode!==0||m.timedOut||m.outputExceeded||JSON.stringify(E(s))!==JSON.stringify(y))throw new Error("private-codex-root-state-isolation-unproven")}}return o(e[0]==="exec"?["exec","-c",w,...f.slice(1)]:["-c",w,...f],n)}}export{M as createPrivateCodexScopedRunner};