@parall/codex-agent 1.18.2 → 1.18.3

package/dist/config.d.ts

@@ -10,7 +10,21 @@ export type CodexAgentConfig = {
     workspaceDir: string;
     model?: string;
     reasoningEffort?: string;
-    sandbox: string;
+    /**
+     * Only set when the user explicitly specified `PRLL_CODEX_SANDBOX`.
+     * When undefined, the bridge deliberately does NOT pass `sandbox` on
+     * `thread/{start,resume}` so codex reads whatever the user configured
+     * in `~/.codex/config.toml` (`sandbox_mode`). This matches the self-
+     * hosted philosophy: user's codex setup is authoritative; bridge only
+     * overrides when the user asks it to.
+     */
+    sandbox?: string;
+    /**
+     * Approval policy is forced to `"never"` by default (not configurable
+     * via config.toml override): Parall's HITL contract routes approvals
+     * through the app, not codex's own stdin-prompt mechanism, which the
+     * long-running app-server subprocess has no way to answer.
+     */
     approvalPolicy: string;
     runtimeKey?: string;
 };

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA6B9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAwC9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrF"}

package/dist/config.js

@@ -14,11 +14,20 @@ export function resolveCodexAgentConfig(env = process.env) {
     const apiUrl = requireEnv(env, "PRLL_API_URL");
     const apiKey = requireEnv(env, "PRLL_API_KEY");
     const orgId = requireEnv(env, "PRLL_ORG_ID");
+    // CODEX_HOME is where codex looks for `auth.json` / `config.toml`. Its
+    // own default is `$HOME/.codex`; falling back to `$HOME` here was wrong
+    // — it made the spawned app-server subprocess look for
+    // `$HOME/auth.json`, which silently doesn't exist, so every
+    // `thread/start` failed with `401 Unauthorized` against the OpenAI
+    // WebSocket endpoint. Default to `$HOME/.codex` so `codex login`'s
+    // credentials are picked up transparently.
     const codexHome = resolvePath(env.PRLL_CODEX_HOME?.trim()
         || env.CODEX_HOME?.trim()
-        || env.HOME
-        || os.homedir());
-    const stateDir = resolvePath(env.PRLL_CODEX_STATE_DIR?.trim() || path.join(codexHome, ".parall-agent"));
+        || path.join(env.HOME || os.homedir(), ".codex"));
+    // Bridge state lives outside CODEX_HOME to avoid polluting codex's own
+    // directory with non-codex files.
+    const stateDir = resolvePath(env.PRLL_CODEX_STATE_DIR?.trim()
+        || path.join(env.HOME || os.homedir(), ".parall-agent"));
     const workspaceDir = resolvePath(env.PRLL_CODEX_WORKSPACE_DIR?.trim() || path.join(stateDir, "workspace"));
     return {
         apiUrl,
@@ -32,7 +41,7 @@ export function resolveCodexAgentConfig(env = process.env) {
         workspaceDir,
         model: env.PRLL_CODEX_MODEL?.trim() || undefined,
         reasoningEffort: env.PRLL_CODEX_REASONING_EFFORT?.trim() || undefined,
-        sandbox: env.PRLL_CODEX_SANDBOX?.trim() || "workspace-write",
+        sandbox: env.PRLL_CODEX_SANDBOX?.trim() || undefined,
         approvalPolicy: env.PRLL_CODEX_APPROVAL?.trim() || "never",
         runtimeKey: env.PRLL_CODEX_RUNTIME_KEY?.trim() || undefined,
     };

package/dist/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,KAAK,4BAA4B,GAAG,IAAI,CACtC,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,SAAS,GACT,cAAc,CACjB,GAAG;IACF,cAAc,EAAE,mBAAmB,CAAC;IACpC,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IA6B/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IA5BjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,IAAI,CAA+C;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;gBAYQ,IAAI,EAAE,4BAA4B;IAExD,QAAQ,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;IA0J3F,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBhG,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,eAAe;IAIrC,OAAO,CAAC,cAAc;IAKhB,IAAI;YAaI,aAAa;YAcb,OAAO;IA2DrB,OAAO,CAAC,qBAAqB;YAiCf,UAAU;IAwCxB,OAAO,CAAC,iBAAiB;CA2B1B"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,KAAK,4BAA4B,GAAG,IAAI,CACtC,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,SAAS,GACT,cAAc,CACjB,GAAG;IACF,cAAc,EAAE,mBAAmB,CAAC;IACpC,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IA6B/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IA5BjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,IAAI,CAA+C;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;gBAYQ,IAAI,EAAE,4BAA4B;IAExD,QAAQ,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;IA0J3F,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBhG,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,eAAe;IAIrC,OAAO,CAAC,cAAc;IAKhB,IAAI;YAaI,aAAa;YAcb,OAAO;IA2DrB,OAAO,CAAC,qBAAqB;YAiCf,UAAU;IAgDxB,OAAO,CAAC,iBAAiB;CA2B1B"}

package/dist/dispatch.js

@@ -359,8 +359,16 @@ export class CodexAppServerAdapter {
         // either kebab or camel and we always emit kebab.
         const commonParams = {
             approvalPolicy: normalizeApprovalPolicy(this.opts.approvalPolicy),
-            sandbox: normalizeSandbox(this.opts.sandbox),
         };
+        // Only override sandbox when the user explicitly set PRLL_CODEX_SANDBOX.
+        // Otherwise let codex read `sandbox_mode` from ~/.codex/config.toml — the
+        // user's own configuration is authoritative for a self-hosted bridge,
+        // and codex 0.120.0's workspace-write mode has a write_stdin bug that
+        // our previous `workspace-write` default tripped for users whose config
+        // had danger-full-access.
+        if (this.opts.sandbox) {
+            commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
+        }
         if (this.opts.model)
             commonParams.model = this.opts.model;
         if (this.opts.reasoningEffort) {

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import * as os from "node:os";
-import { ParallAgentGateway } from "@parall/agent-core";
+import { ParallAgentGateway, parseShutdownDeadlineMs } from "@parall/agent-core";
 import { ParallClient, ParallWs } from "@parall/sdk";
 import { buildCodexRuntimeKey, resolveCodexAgentConfig, resolveWsUrl, sessionStateFilePathForRuntime, stepIdFilePathForSession, } from "./config.js";
 import { CodexAppServerAdapter } from "./dispatch.js";
@@ -65,6 +65,7 @@ async function main() {
         },
         dispatchAdapter: adapter,
         log,
+        shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
         stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
     });
     const abortController = new AbortController();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/codex-agent",
-  "version": "1.18.2",
+  "version": "1.18.3",
   "description": "Codex CLI bridge runtime for self-hosted Parall agents",
   "license": "MIT",
   "repository": {

package/src/config.ts

@@ -13,7 +13,21 @@ export type CodexAgentConfig = {
   workspaceDir: string;
   model?: string;
   reasoningEffort?: string;
-  sandbox: string;
+  /**
+   * Only set when the user explicitly specified `PRLL_CODEX_SANDBOX`.
+   * When undefined, the bridge deliberately does NOT pass `sandbox` on
+   * `thread/{start,resume}` so codex reads whatever the user configured
+   * in `~/.codex/config.toml` (`sandbox_mode`). This matches the self-
+   * hosted philosophy: user's codex setup is authoritative; bridge only
+   * overrides when the user asks it to.
+   */
+  sandbox?: string;
+  /**
+   * Approval policy is forced to `"never"` by default (not configurable
+   * via config.toml override): Parall's HITL contract routes approvals
+   * through the app, not codex's own stdin-prompt mechanism, which the
+   * long-running app-server subprocess has no way to answer.
+   */
   approvalPolicy: string;
   runtimeKey?: string;
 };
@@ -34,13 +48,24 @@ export function resolveCodexAgentConfig(env: NodeJS.ProcessEnv = process.env): C
   const apiUrl = requireEnv(env, "PRLL_API_URL");
   const apiKey = requireEnv(env, "PRLL_API_KEY");
   const orgId = requireEnv(env, "PRLL_ORG_ID");
+  // CODEX_HOME is where codex looks for `auth.json` / `config.toml`. Its
+  // own default is `$HOME/.codex`; falling back to `$HOME` here was wrong
+  // — it made the spawned app-server subprocess look for
+  // `$HOME/auth.json`, which silently doesn't exist, so every
+  // `thread/start` failed with `401 Unauthorized` against the OpenAI
+  // WebSocket endpoint. Default to `$HOME/.codex` so `codex login`'s
+  // credentials are picked up transparently.
   const codexHome = resolvePath(
     env.PRLL_CODEX_HOME?.trim()
       || env.CODEX_HOME?.trim()
-      || env.HOME
-      || os.homedir(),
+      || path.join(env.HOME || os.homedir(), ".codex"),
+  );
+  // Bridge state lives outside CODEX_HOME to avoid polluting codex's own
+  // directory with non-codex files.
+  const stateDir = resolvePath(
+    env.PRLL_CODEX_STATE_DIR?.trim()
+      || path.join(env.HOME || os.homedir(), ".parall-agent"),
   );
-  const stateDir = resolvePath(env.PRLL_CODEX_STATE_DIR?.trim() || path.join(codexHome, ".parall-agent"));
   const workspaceDir = resolvePath(env.PRLL_CODEX_WORKSPACE_DIR?.trim() || path.join(stateDir, "workspace"));
 
   return {
@@ -55,7 +80,7 @@ export function resolveCodexAgentConfig(env: NodeJS.ProcessEnv = process.env): C
     workspaceDir,
     model: env.PRLL_CODEX_MODEL?.trim() || undefined,
     reasoningEffort: env.PRLL_CODEX_REASONING_EFFORT?.trim() || undefined,
-    sandbox: env.PRLL_CODEX_SANDBOX?.trim() || "workspace-write",
+    sandbox: env.PRLL_CODEX_SANDBOX?.trim() || undefined,
     approvalPolicy: env.PRLL_CODEX_APPROVAL?.trim() || "never",
     runtimeKey: env.PRLL_CODEX_RUNTIME_KEY?.trim() || undefined,
   };

package/src/dispatch.ts

@@ -402,8 +402,16 @@ export class CodexAppServerAdapter implements DispatchAdapter {
     // either kebab or camel and we always emit kebab.
     const commonParams: Record<string, unknown> = {
       approvalPolicy: normalizeApprovalPolicy(this.opts.approvalPolicy),
-      sandbox: normalizeSandbox(this.opts.sandbox),
     };
+    // Only override sandbox when the user explicitly set PRLL_CODEX_SANDBOX.
+    // Otherwise let codex read `sandbox_mode` from ~/.codex/config.toml — the
+    // user's own configuration is authoritative for a self-hosted bridge,
+    // and codex 0.120.0's workspace-write mode has a write_stdin bug that
+    // our previous `workspace-write` default tripped for users whose config
+    // had danger-full-access.
+    if (this.opts.sandbox) {
+      commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
+    }
     if (this.opts.model) commonParams.model = this.opts.model;
     if (this.opts.reasoningEffort) {
       // The app-server JSON-RPC surface uses camelCase for overrides —

package/src/index.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import * as os from "node:os";
-import { ParallAgentGateway } from "@parall/agent-core";
+import { ParallAgentGateway, parseShutdownDeadlineMs } from "@parall/agent-core";
 import { ParallClient, ParallWs } from "@parall/sdk";
 import {
   buildCodexRuntimeKey,
@@ -83,6 +83,7 @@ async function main() {
     },
     dispatchAdapter: adapter,
     log,
+    shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
     stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
   });