@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/private-execution/codex-host-runtime.js

@@ -1 +1,137 @@
-import{startPrivateCodexHomeGuard as L}from"./codex-lifecycle-guard.js";import{createHash as k}from"node:crypto";import{closeSync as H,constants as O,fstatSync as z,lstatSync as g,mkdtempSync as M,openSync as R,readFileSync as T,realpathSync as S,rmSync as _,writeFileSync as C}from"node:fs";import{isAbsolute as P,join as c,relative as W}from"node:path";const p=d=>k("sha256").update(d).digest("hex"),w=new Set;let b=!1;function r(){throw new Error("private-codex-host-runtime-unverified")}function a(d,v){const f=R(d,O.O_RDONLY|O.O_NOFOLLOW|O.O_NONBLOCK);try{const e=z(f);(!e.isFile()||e.uid!==process.getuid?.()||e.nlink!==1||e.mode&18||v&&(e.mode&511)!==384||e.size<1||e.size>1048576)&&r();const l=T(f),s=z(f),m=g(d);return(l.length!==e.size||[s,m].some(t=>t.dev!==e.dev||t.ino!==e.ino||t.size!==e.size||t.mtimeMs!==e.mtimeMs||t.ctimeMs!==e.ctimeMs||t.mode!==e.mode||t.nlink!==1))&&r(),l}finally{H(f)}}function K(d,v){try{const f=S(d),e=S(v),l=W(f,e),s=g(e);(!l||!l.startsWith("..")&&!P(l)||!s.isDirectory()||s.uid!==process.getuid?.()||s.mode&18)&&r();const m=a(c(e,"auth.json"),!0);let t;try{t=a(c(e,"config.toml"),!1)}catch(o){if(o.code!=="ENOENT")throw o}const D=p(m),F=t?p(t):void 0,n=M(c(e,".neocortex-executor-")),N=g(n),u=process.platform==="linux"?L(n):void 0;let x=!1;const E=()=>{const o=g(n),i=g(e);(S(e)!==e||i.dev!==s.dev||i.ino!==s.ino||i.uid!==s.uid||i.mode&18||o.dev!==N.dev||o.ino!==N.ino||o.uid!==process.getuid?.()||(o.mode&511)!==448||!o.isDirectory()||o.isSymbolicLink())&&r()};let y;const j=()=>{if(!x)try{E(),_(n,{recursive:!0}),x=!0,y&&w.delete(y),u?.connected&&u.disconnect()}catch{r()}};try{C(c(n,"auth.json"),m,{mode:384,flag:"wx"}),t&&C(c(n,"config.toml"),t,{mode:384,flag:"wx"}),m.fill(0),t?.fill(0);const o=()=>{try{(x||u&&(!u.connected||u.exitCode!==null||u.signalCode!==null))&&r(),E(),p(a(c(e,"auth.json"),!0))!==D&&r();let i;try{i=a(c(e,"config.toml"),!1)}catch(h){if(h.code!=="ENOENT")throw h}(i?p(i):void 0)!==F&&r(),a(c(n,"auth.json"),!0);try{a(c(n,"config.toml"),!0)}catch(h){if(h.code!=="ENOENT")throw h}}catch{r()}};return o(),y=Object.freeze({home:n,sourceHome:e,verify:o,close:j}),w.add(y),b||(b=!0,process.once("exit",()=>{for(const i of w)try{i.close()}catch{}})),y}catch(o){throw j(),o}}catch{r()}}export{K as createPrivateCodexHostRuntime};
+import { startPrivateCodexHomeGuard } from './codex-lifecycle-guard.js';
+/** Host control state for one subscription execution. Never a QA checkout or image. */
+import { createHash } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, mkdtempSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, relative } from 'node:path';
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const liveRuntimes = new Set();
+let exitCleanupInstalled = false;
+function fail() { throw new Error('private-codex-host-runtime-unverified'); }
+function readFile(path, credential) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = fstatSync(fd);
+        if (!before.isFile() || before.uid !== process.getuid?.() || before.nlink !== 1
+            || before.mode & 0o022 || credential && (before.mode & 0o777) !== 0o600
+            || before.size < 1 || before.size > 1048576)
+            fail();
+        const bytes = readFileSync(fd), after = fstatSync(fd), current = lstatSync(path);
+        if (bytes.length !== before.size || [after, current].some(s => s.dev !== before.dev || s.ino !== before.ino
+            || s.size !== before.size || s.mtimeMs !== before.mtimeMs || s.ctimeMs !== before.ctimeMs
+            || s.mode !== before.mode || s.nlink !== 1))
+            fail();
+        return bytes;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** The CLI may record project trust in its own configuration. Keep that write in
+ * short-lived, owner-private host control storage using the existing account.
+ * No credential is placed in, mounted into or passed to the model checkout. */
+export function createPrivateCodexHostRuntime(projectRoot, sourceHome) {
+    try {
+        const root = realpathSync(projectRoot), source = realpathSync(sourceHome), relation = relative(root, source);
+        const parent = lstatSync(source);
+        if (!relation || !relation.startsWith('..') && !isAbsolute(relation)
+            || !parent.isDirectory() || parent.uid !== process.getuid?.() || parent.mode & 0o022)
+            fail();
+        const auth = readFile(join(source, 'auth.json'), true);
+        let config;
+        try {
+            config = readFile(join(source, 'config.toml'), false);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const authDigest = digest(auth), configDigest = config ? digest(config) : undefined;
+        const home = mkdtempSync(join(source, '.neocortex-executor-')), identity = lstatSync(home);
+        const guard = process.platform === 'linux' ? startPrivateCodexHomeGuard(home) : undefined;
+        let closed = false;
+        const custody = () => {
+            const current = lstatSync(home), directory = lstatSync(source);
+            if (realpathSync(source) !== source || directory.dev !== parent.dev || directory.ino !== parent.ino
+                || directory.uid !== parent.uid || directory.mode & 0o022 || current.dev !== identity.dev || current.ino !== identity.ino
+                || current.uid !== process.getuid?.() || (current.mode & 0o777) !== 0o700 || !current.isDirectory()
+                || current.isSymbolicLink())
+                fail();
+        };
+        let runtime;
+        const close = () => {
+            if (closed)
+                return;
+            try {
+                custody();
+                rmSync(home, { recursive: true });
+                closed = true;
+                if (runtime)
+                    liveRuntimes.delete(runtime);
+                if (guard?.connected)
+                    guard.disconnect();
+            }
+            catch {
+                fail();
+            }
+        };
+        try {
+            writeFileSync(join(home, 'auth.json'), auth, { mode: 0o600, flag: 'wx' });
+            if (config)
+                writeFileSync(join(home, 'config.toml'), config, { mode: 0o600, flag: 'wx' });
+            auth.fill(0);
+            config?.fill(0);
+            const verify = () => {
+                try {
+                    if (closed || guard && (!guard.connected || guard.exitCode !== null || guard.signalCode !== null))
+                        fail();
+                    custody();
+                    if (digest(readFile(join(source, 'auth.json'), true)) !== authDigest)
+                        fail();
+                    let current;
+                    try {
+                        current = readFile(join(source, 'config.toml'), false);
+                    }
+                    catch (error) {
+                        if (error.code !== 'ENOENT')
+                            throw error;
+                    }
+                    if ((current ? digest(current) : undefined) !== configDigest)
+                        fail();
+                    readFile(join(home, 'auth.json'), true);
+                    try {
+                        readFile(join(home, 'config.toml'), true);
+                    }
+                    catch (error) {
+                        if (error.code !== 'ENOENT')
+                            throw error;
+                    }
+                }
+                catch {
+                    fail();
+                }
+            };
+            verify();
+            runtime = Object.freeze({ home, sourceHome: source, verify, close });
+            liveRuntimes.add(runtime);
+            if (!exitCleanupInstalled) {
+                exitCleanupInstalled = true;
+                process.once('exit', () => {
+                    for (const pending of liveRuntimes) {
+                        try {
+                            pending.close();
+                        }
+                        catch { /* Preserve a directory whose custody became ambiguous. */ }
+                    }
+                });
+            }
+            return runtime;
+        }
+        catch (error) {
+            close();
+            throw error;
+        }
+    }
+    catch {
+        fail();
+    }
+}

package/packages/client/dist/private-execution/codex-lifecycle-guard.js

@@ -1 +1,97 @@
-import{spawn as i}from"node:child_process";import{lstatSync as d,realpathSync as a,rmSync as u}from"node:fs";import{basename as f}from"node:path";import{fileURLToPath as m}from"node:url";const p=m(new URL(import.meta.url.endsWith(".ts")?"../../dist/private-execution/codex-lifecycle-guard.js":"./codex-lifecycle-guard.js",import.meta.url));function L(r){const e=d(r),c=i(process.execPath,[p,"home",r,String(e.dev),String(e.ino)],{detached:!0,env:{},stdio:["ignore","ignore","ignore","ipc"]});return c.on("error",()=>{}),c.unref(),c.channel?.unref(),c}function n(){process.kill(-process.pid,"SIGKILL"),process.exit(1)}function l(){const[r,e,c]=process.argv.slice(3);let s=!1;const o=()=>{if(!s){s=!0;try{if(!r||!f(r).startsWith(".neocortex-executor-"))throw new Error;const t=d(r);if(a(r)!==r||!t.isDirectory()||t.isSymbolicLink()||t.uid!==process.getuid?.()||(t.mode&511)!==448||String(t.dev)!==e||String(t.ino)!==c)throw new Error;u(r,{recursive:!0}),process.exit(0)}catch(t){process.exit(t.code==="ENOENT"?0:1)}}};process.on("disconnect",o),process.connected||o()}function x(){process.on("disconnect",n),process.on("SIGTERM",n),process.on("SIGINT",n),process.stdout.on("error",n),process.stderr.on("error",n),process.connected||n(),process.once("message",r=>{const e=r;(!e||e.kind!=="private-codex-launch"||!Array.isArray(e.args)||e.args.some(o=>typeof o!="string")||e.codexHome!==void 0&&typeof e.codexHome!="string")&&n();const c=e.args,s=i(e.codexHome===void 0?"codex":"/bin/sh",e.codexHome===void 0?c:["-c",'umask 077; exec codex "$@"',"neocortex-private-codex",...c],{cwd:process.cwd(),env:Object.fromEntries(["PATH","HOME","LANG","LC_ALL","TERM","CODEX_HOME"].filter(o=>process.env[o]!==void 0).map(o=>[o,process.env[o]])),detached:!1,stdio:["pipe","pipe","pipe"]});process.stdin.pipe(s.stdin),s.stdin.on("error",()=>{}),s.stdout.pipe(process.stdout),s.stderr.pipe(process.stderr),s.on("error",n),s.on("close",o=>{process.stdin.unpipe(s.stdin),process.stdin.pause(),process.removeListener("disconnect",n),process.connected&&process.disconnect?.(),process.exitCode=typeof o=="number"?o:1})})}process.argv[1]===p&&process.platform==="linux"&&(process.argv[2]==="home"?l():process.argv[2]==="process"?x():process.exit(1));export{p as codexLifecycleGuardPath,L as startPrivateCodexHomeGuard};
+/** Mechanical Linux process/custody lifetime; no workflow material or authority. */
+import { spawn } from 'node:child_process';
+import { lstatSync, realpathSync, rmSync } from 'node:fs';
+import { basename } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// Source-driven development tests launch the same compiled helper as the CLI.
+export const codexLifecycleGuardPath = fileURLToPath(new URL(import.meta.url.endsWith('.ts')
+    ? '../../dist/private-execution/codex-lifecycle-guard.js' : './codex-lifecycle-guard.js', import.meta.url));
+export function startPrivateCodexHomeGuard(home) {
+    const identity = lstatSync(home);
+    const guard = spawn(process.execPath, [codexLifecycleGuardPath, 'home', home, String(identity.dev), String(identity.ino)], {
+        detached: true, env: {}, stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+    });
+    // A failed guard is observed by runtime.verify(); never print host paths.
+    guard.on('error', () => undefined);
+    guard.unref();
+    guard.channel?.unref();
+    return guard;
+}
+function stopOwnGroup() {
+    // This process remains the group leader until this syscall: no stale PID kill.
+    process.kill(-process.pid, 'SIGKILL');
+    process.exit(1);
+}
+function homeGuard() {
+    const [home, dev, ino] = process.argv.slice(3);
+    let handled = false;
+    const close = () => {
+        if (handled)
+            return;
+        handled = true;
+        try {
+            if (!home || !basename(home).startsWith('.neocortex-executor-'))
+                throw new Error();
+            const identity = lstatSync(home);
+            if (realpathSync(home) !== home || !identity.isDirectory() || identity.isSymbolicLink()
+                || identity.uid !== process.getuid?.() || (identity.mode & 0o777) !== 0o700
+                || String(identity.dev) !== dev || String(identity.ino) !== ino)
+                throw new Error();
+            rmSync(home, { recursive: true });
+            process.exit(0);
+        }
+        catch (error) {
+            // Missing means the root already closed it. Ambiguous custody is retained.
+            process.exit(error.code === 'ENOENT' ? 0 : 1);
+        }
+    };
+    process.on('disconnect', close);
+    if (!process.connected)
+        close();
+}
+function processGuard() {
+    process.on('disconnect', stopOwnGroup);
+    process.on('SIGTERM', stopOwnGroup);
+    process.on('SIGINT', stopOwnGroup);
+    process.stdout.on('error', stopOwnGroup);
+    process.stderr.on('error', stopOwnGroup);
+    if (!process.connected)
+        stopOwnGroup();
+    process.once('message', (value) => {
+        const input = value;
+        if (!input || input.kind !== 'private-codex-launch' || !Array.isArray(input.args)
+            || input.args.some(arg => typeof arg !== 'string')
+            || input.codexHome !== undefined && typeof input.codexHome !== 'string')
+            stopOwnGroup();
+        const args = input.args;
+        const child = spawn(input.codexHome === undefined ? 'codex' : '/bin/sh', input.codexHome === undefined
+            ? args : ['-c', 'umask 077; exec codex "$@"', 'neocortex-private-codex', ...args], {
+            cwd: process.cwd(), env: Object.fromEntries(['PATH', 'HOME', 'LANG', 'LC_ALL', 'TERM', 'CODEX_HOME']
+                .filter(key => process.env[key] !== undefined).map(key => [key, process.env[key]])),
+            detached: false, stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        process.stdin.pipe(child.stdin);
+        child.stdin.on('error', () => undefined);
+        child.stdout.pipe(process.stdout);
+        child.stderr.pipe(process.stderr);
+        child.on('error', stopOwnGroup);
+        child.on('close', code => {
+            // close waits for inherited pipes, retaining this live group anchor.
+            process.stdin.unpipe(child.stdin);
+            process.stdin.pause();
+            process.removeListener('disconnect', stopOwnGroup);
+            if (process.connected)
+                process.disconnect?.();
+            // Natural exit drains forwarded stdout/stderr before the root reads close.
+            process.exitCode = typeof code === 'number' ? code : 1;
+        });
+    });
+}
+if (process.argv[1] === codexLifecycleGuardPath && process.platform === 'linux') {
+    if (process.argv[2] === 'home')
+        homeGuard();
+    else if (process.argv[2] === 'process')
+        processGuard();
+    else
+        process.exit(1);
+}

package/packages/client/dist/private-execution/codex-scoped-permissions.js

@@ -1 +1,128 @@
-import{randomBytes as g}from"node:crypto";import{accessSync as D,constants as J,lstatSync as S,readdirSync as N,realpathSync as u}from"node:fs";import{homedir as R}from"node:os";import{createRequire as k}from"node:module";import{basename as $,delimiter as P,dirname as x,join as a,resolve as l,sep as b}from"node:path";import{gitLifecycleRuntimeDirectory as _}from"../git/git-lifecycle-store.js";function E(p){const o=new Set;for(const t of p){const r=S(t);if(!r.isDirectory()||r.isSymbolicLink()||u(t)!==t)throw new Error("private-codex-root-state-isolation-unproven");for(const s of N(t)){if(!s.startsWith("neocortex-"))continue;const d=a(t,s),c=S(d);if(!/^[A-Za-z0-9._-]{1,128}$/.test(s)||c.isSymbolicLink()||!c.isDirectory()&&!c.isFile())throw new Error("private-codex-root-state-isolation-unproven");if(o.add(d),o.size>64)throw new Error("private-codex-root-state-isolation-unproven")}}return[...o].sort()}function C(){for(const p of(process.env.PATH??"").split(P).filter(Boolean))try{const o=u(a(p,"codex"));if(D(o,J.X_OK),!S(o).isFile())continue;if($(o)!=="codex.js"||$(x(o))!=="bin")return[x(o)];const t=[x(x(o))],r=process.arch==="x64"?"@openai/codex-linux-x64":process.arch==="arm64"?"@openai/codex-linux-arm64":void 0;if(r)try{t.push(u(x(k(o).resolve(`${r}/package.json`))))}catch{}return[...new Set(t)]}catch{}throw new Error("private-codex-version-unavailable")}async function M(p,o,t){const r=u(l(p)),s=Object.freeze([...t.gitControlDirectories]),d=t.userHome??R(),c=t.codexHome??process.env.CODEX_HOME??a(d,".codex"),O=C();if(O.some(e=>[b,l(d),l(c),r].includes(e)||e.startsWith(r+b)))throw new Error("private-codex-executable-scope-unsafe");const j=await _(r),y=E(s),i={":root":"deny",":minimal":"read",[r]:"write",[a(d,".ssh")]:"deny",[a(c,"auth.json")]:"deny"};if(t.credentialSourceHome){const e=l(t.credentialSourceHome),n=l(c);i[e]="deny",n!==e&&!n.startsWith(e+b)&&(i[n]="deny"),delete i[a(c,"auth.json")]}for(const e of O)i[e]="read";for(const e of s)i[e]="read";i[a(r,".git")]="read",i[j]="deny";for(const e of y)i[e]="deny";const h=`p222-isolated-${g(16).toString("hex")}`,w=`permissions.${h}={filesystem={${Object.entries(i).map(([e,n])=>`${JSON.stringify(e)}=${JSON.stringify(n)}`).join(",")}},network={enabled=false}}`;return async(e,n)=>{if(u(l(n.cwd))!==r)throw new Error("private-codex-execution-root-drift");if(JSON.stringify(E(s))!==JSON.stringify(y))throw new Error("private-codex-root-state-isolation-unproven");if(e[0]!=="sandbox"&&e[0]!=="exec")return o(e,n);const f=[...e];if(e[0]==="sandbox"){if(e[1]!=="-P"||e[2]!=="p222-isolated")throw new Error("private-codex-permission-profile-invalid");f[2]=h}else{const H=f.findIndex((v,m)=>v==='default_permissions="p222-isolated"'&&f[m-1]==="-c");if(H<0)throw new Error("private-codex-permission-profile-invalid");f[H]=`default_permissions="${h}"`;for(const v of y){const m=await o(["-c",w,"sandbox","-P",h,"--","sh","-c",'test ! -r "$1"',"sh",v],{cwd:r,timeoutMs:1e4,maxOutputBytes:16384});if(m.exitCode!==0||m.timedOut||m.outputExceeded||JSON.stringify(E(s))!==JSON.stringify(y))throw new Error("private-codex-root-state-isolation-unproven")}}return o(e[0]==="exec"?["exec","-c",w,...f.slice(1)]:["-c",w,...f],n)}}export{M as createPrivateCodexScopedRunner};
+import { randomBytes } from 'node:crypto';
+import { accessSync, constants, lstatSync, readdirSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { createRequire } from 'node:module';
+import { basename, delimiter, dirname, join, resolve, sep } from 'node:path';
+import { gitLifecycleRuntimeDirectory } from '../git/git-lifecycle-store.js';
+/** SDK state shares the Git control directory but is not model-readable Git metadata. */
+function rootOwnedGitStores(directories) {
+    const paths = new Set();
+    for (const directory of directories) {
+        const control = lstatSync(directory);
+        if (!control.isDirectory() || control.isSymbolicLink() || realpathSync(directory) !== directory) {
+            throw new Error('private-codex-root-state-isolation-unproven');
+        }
+        for (const name of readdirSync(directory)) {
+            if (!name.startsWith('neocortex-'))
+                continue;
+            const path = join(directory, name), entry = lstatSync(path);
+            if (!/^[A-Za-z0-9._-]{1,128}$/.test(name) || entry.isSymbolicLink()
+                || !entry.isDirectory() && !entry.isFile())
+                throw new Error('private-codex-root-state-isolation-unproven');
+            paths.add(path);
+            if (paths.size > 64)
+                throw new Error('private-codex-root-state-isolation-unproven');
+        }
+    }
+    return [...paths].sort();
+}
+function executableReadRoots() {
+    for (const directory of (process.env.PATH ?? '').split(delimiter).filter(Boolean)) {
+        try {
+            const executable = realpathSync(join(directory, 'codex'));
+            accessSync(executable, constants.X_OK);
+            if (!lstatSync(executable).isFile())
+                continue;
+            if (basename(executable) !== 'codex.js' || basename(dirname(executable)) !== 'bin')
+                return [dirname(executable)];
+            const roots = [dirname(dirname(executable))];
+            const platformPackage = process.arch === 'x64' ? '@openai/codex-linux-x64'
+                : process.arch === 'arm64' ? '@openai/codex-linux-arm64' : undefined;
+            if (platformPackage) {
+                try {
+                    roots.push(realpathSync(dirname(createRequire(executable).resolve(`${platformPackage}/package.json`))));
+                }
+                catch { /* Older installations keep the native executable in the CLI package. */ }
+            }
+            return [...new Set(roots)];
+        }
+        catch { /* Continue searching the same executable path used by spawn. */ }
+    }
+    throw new Error('private-codex-version-unavailable');
+}
+/** Per-invocation permissions; never modifies the operator's configuration. */
+export async function createPrivateCodexScopedRunner(projectRoot, base, options) {
+    const root = realpathSync(resolve(projectRoot));
+    const controlDirectories = Object.freeze([...options.gitControlDirectories]);
+    const userHome = options.userHome ?? homedir();
+    const codexHome = options.codexHome ?? process.env.CODEX_HOME ?? join(userHome, '.codex');
+    const binaryRoots = executableReadRoots();
+    if (binaryRoots.some((path) => [sep, resolve(userHome), resolve(codexHome), root].includes(path)
+        || path.startsWith(root + sep)))
+        throw new Error('private-codex-executable-scope-unsafe');
+    const lifecycle = await gitLifecycleRuntimeDirectory(root);
+    const stores = rootOwnedGitStores(controlDirectories);
+    const filesystem = {
+        ':root': 'deny', ':minimal': 'read', [root]: 'write',
+        [join(userHome, '.ssh')]: 'deny', [join(codexHome, 'auth.json')]: 'deny',
+    };
+    if (options.credentialSourceHome) {
+        const sourceHome = resolve(options.credentialSourceHome), privateHome = resolve(codexHome);
+        filesystem[sourceHome] = 'deny';
+        if (privateHome !== sourceHome && !privateHome.startsWith(sourceHome + sep))
+            filesystem[privateHome] = 'deny';
+        // A denied ancestor covers the credential file. A second bind beneath an
+        // already denied directory cannot be created by the Linux sandbox.
+        delete filesystem[join(codexHome, 'auth.json')];
+    }
+    for (const directory of binaryRoots)
+        filesystem[directory] = 'read';
+    for (const directory of controlDirectories)
+        filesystem[directory] = 'read';
+    // Linked worktrees also have a .git control file inside the writable checkout.
+    filesystem[join(root, '.git')] = 'read';
+    filesystem[lifecycle] = 'deny';
+    for (const path of stores)
+        filesystem[path] = 'deny';
+    const profile = `p222-isolated-${randomBytes(16).toString('hex')}`;
+    const configuration = `permissions.${profile}={filesystem={${Object.entries(filesystem)
+        .map(([path, mode]) => `${JSON.stringify(path)}=${JSON.stringify(mode)}`).join(',')}},network={enabled=false}}`;
+    return async (args, runOptions) => {
+        if (realpathSync(resolve(runOptions.cwd)) !== root)
+            throw new Error('private-codex-execution-root-drift');
+        if (JSON.stringify(rootOwnedGitStores(controlDirectories)) !== JSON.stringify(stores)) {
+            throw new Error('private-codex-root-state-isolation-unproven');
+        }
+        if (args[0] !== 'sandbox' && args[0] !== 'exec')
+            return base(args, runOptions);
+        const scoped = [...args];
+        if (args[0] === 'sandbox') {
+            if (args[1] !== '-P' || args[2] !== 'p222-isolated')
+                throw new Error('private-codex-permission-profile-invalid');
+            scoped[2] = profile;
+        }
+        else {
+            const index = scoped.findIndex((arg, i) => arg === 'default_permissions="p222-isolated"' && scoped[i - 1] === '-c');
+            if (index < 0)
+                throw new Error('private-codex-permission-profile-invalid');
+            scoped[index] = `default_permissions="${profile}"`;
+            // Prove every currently registered private SDK store is unreadable at
+            // the material boundary. Probes receive no model material on stdin.
+            for (const path of stores) {
+                const probe = await base(['-c', configuration, 'sandbox', '-P', profile,
+                    '--', 'sh', '-c', 'test ! -r "$1"', 'sh', path], {
+                    cwd: root, timeoutMs: 10000, maxOutputBytes: 16384,
+                });
+                if (probe.exitCode !== 0 || probe.timedOut || probe.outputExceeded
+                    || JSON.stringify(rootOwnedGitStores(controlDirectories)) !== JSON.stringify(stores)) {
+                    throw new Error('private-codex-root-state-isolation-unproven');
+                }
+            }
+        }
+        // exec owns its own -c parser. Keep the profile in the same override set
+        // as default_permissions; a root-level override can be shadowed there.
+        return base(args[0] === 'exec'
+            ? ['exec', '-c', configuration, ...scoped.slice(1)]
+            : ['-c', configuration, ...scoped], runOptions);
+    };
+}