@prismatic-io/lux 0.0.2-preview.20 → 0.0.2-preview.22

package/src/drivers/codex/config.ts

@@ -46,6 +46,8 @@ export const CodexDriverConfigSchema = z
     strictConfig: z.boolean().default(false),
     interactionMode: z.enum(["app-server", "exec"]).default("app-server"),
     approvalPolicy: z.enum(["untrusted", "on-request", "never"]).default("on-request"),
+    /** Native reviewer for eligible approvals; auto_review requires app-server and on-request. */
+    approvalsReviewer: z.enum(["user", "auto_review"]).default("user"),
     isolation: IsolationSchema.optional(),
     maxInterrupts: z.number().positive().default(20),
     maxLineBytes: z.number().positive().default(10_000_000),
@@ -53,6 +55,16 @@ export const CodexDriverConfigSchema = z
   })
   .strict()
   .superRefine((config, ctx) => {
+    if (
+      config.approvalsReviewer === "auto_review" &&
+      (config.interactionMode !== "app-server" || config.approvalPolicy !== "on-request")
+    ) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["approvalsReviewer"],
+        message: "auto_review requires app-server interaction mode and on-request approval policy",
+      });
+    }
     if (config.interactionMode === "app-server" && config.profile) {
       ctx.addIssue({
         code: "custom",
@@ -103,6 +115,27 @@ const tomlValue = (value: CodexConfigValue): string => {
     .join(",")}}`;
 };
 
+// Codex shell snapshots can replace the launching process's PATH. Pin only
+// executable-search variables here; never put other environment secrets in argv.
+export const codexConfigOverrides = (
+  config: CodexDriverConfig,
+): Record<string, CodexConfigValue> => {
+  const authored = config.config ?? {};
+  const paths = Object.fromEntries(
+    Object.entries(config.env ?? {}).filter(
+      ([key]) => key.toUpperCase() === "PATH" || key.toUpperCase() === "PATHEXT",
+    ),
+  );
+  if (Object.keys(paths).length === 0) return authored;
+  const object = (value: CodexConfigValue | undefined): Record<string, CodexConfigValue> =>
+    value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const policy = object(authored.shell_environment_policy);
+  return {
+    ...authored,
+    shell_environment_policy: { ...policy, set: { ...paths, ...object(policy.set) } },
+  };
+};
+
 export const buildExecArgs = (config: CodexDriverConfig): string[] => {
   const args = ["exec", "--json", "--color", "never", "--sandbox", config.sandbox];
   args.push("--model", config.model);
@@ -113,7 +146,7 @@ export const buildExecArgs = (config: CodexDriverConfig): string[] => {
   if (config.ignoreRules) args.push("--ignore-rules");
   if (config.strictConfig) args.push("--strict-config");
   for (const directory of config.addDirs ?? []) args.push("--add-dir", directory);
-  for (const [key, value] of Object.entries(config.config ?? {})) {
+  for (const [key, value] of Object.entries(codexConfigOverrides(config))) {
     args.push("--config", `${key}=${tomlValue(value)}`);
   }
   args.push(...effortArgs(config));
@@ -125,7 +158,7 @@ export const buildExecArgs = (config: CodexDriverConfig): string[] => {
 export const buildAppServerArgs = (config: CodexDriverConfig): string[] => {
   const args = ["app-server", "--stdio"];
   if (config.strictConfig) args.push("--strict-config");
-  for (const [key, value] of Object.entries(config.config ?? {})) {
+  for (const [key, value] of Object.entries(codexConfigOverrides(config))) {
     args.push("--config", `${key}=${tomlValue(value)}`);
   }
   args.push(...effortArgs(config));

package/src/drivers/codex/index.ts

@@ -41,6 +41,7 @@ import {
   type CodexConfigValue,
   type CodexDriverConfig,
   CodexDriverConfigSchema,
+  codexConfigOverrides,
 } from "./config.js";
 
 import { makeParseEvent } from "./exec-events.js";
@@ -189,7 +190,7 @@ class CodexAppServerDriverImpl implements AgentDriver {
       ? await Promise.all(this.config.isolation.allowRead.map((path) => realpath(path)))
       : [];
     const threadConfig: Record<string, CodexConfigValue> = {
-      ...(this.config.config ?? {}),
+      ...codexConfigOverrides(this.config),
       ...(this.config.reasoningEffort
         ? { model_reasoning_effort: this.config.reasoningEffort }
         : {}),
@@ -215,13 +216,21 @@ class CodexAppServerDriverImpl implements AgentDriver {
       cwd,
       runtimeWorkspaceRoots: this.config.addDirs ?? [],
       approvalPolicy: this.config.approvalPolicy,
-      approvalsReviewer: "user",
+      approvalsReviewer: this.config.approvalsReviewer,
       ...(this.config.isolation
         ? { permissions: "lux-isolated" }
         : { sandbox: this.config.sandbox }),
       config: threadConfig,
       ephemeral: this.config.ephemeral,
     });
+    if (
+      this.config.approvalsReviewer === "auto_review" &&
+      started.approvalsReviewer !== "auto_review"
+    ) {
+      throw new Error(
+        "codex app-server did not enable the requested auto_review approvals reviewer",
+      );
+    }
     const thread = asRecord(started.thread);
     if (!thread || typeof thread.id !== "string") {
       throw new Error("codex app-server returned an invalid thread/start response");
@@ -232,6 +241,7 @@ class CodexAppServerDriverImpl implements AgentDriver {
       model: typeof started.model === "string" ? started.model : this.config.model,
       detail: {
         threadId: thread.id,
+        approvalsReviewer: this.config.approvalsReviewer,
         ...(typeof thread.sessionId === "string" ? { sessionId: thread.sessionId } : {}),
         ...(this.cliVersion ? { cliVersion: this.cliVersion } : {}),
       },

package/src/drivers/subprocess/index.ts

@@ -148,7 +148,7 @@ class SubprocessDriverImpl implements AgentDriver {
       throw new Error(`subprocess fixture values exceed ${MAX_FIXTURE_VALUES_BYTES} bytes`);
     }
     const managed = spawnManagedProcess(this.config.command, this.config.args ?? [], {
-      cwd: this.config.cwd ?? ctx.runDir,
+      cwd: this.config.cwd ?? ctx.artifactsDir,
       env: {
         ...(this.config.inheritEnv === false ? {} : process.env),
         ...this.config.env,

package/src/orchestrator/run-execution.ts

@@ -53,6 +53,7 @@ import {
   type RunFailurePhase,
   type RunLifecycleEffects,
 } from "./run-lifecycle.js";
+import { RunWorkspace } from "./run-workspace.js";
 import { isRunTraceLimit, type RunTraceLimitFailure } from "./trace-limits.js";
 
 /** Sentinel `casePath` for a pre-loaded case that has no file behind it. */
@@ -313,6 +314,7 @@ class RunExecution implements RunLifecycleEffects<RunResult> {
   private metadata: RunMetadata | undefined;
   private usage: RunUsage | undefined;
   private run: Run | undefined;
+  private workspace: RunWorkspace | undefined;
 
   private constructor(
     args: RunWithPluginsArgs,
@@ -369,10 +371,11 @@ class RunExecution implements RunLifecycleEffects<RunResult> {
     const { request, evalCase, casePath, driver } = this.args;
     this.lifecycle("run-loop");
     if (request.abortSignal?.aborted) return;
+    this.workspace = await RunWorkspace.create();
     const staged = await stageFixtures(evalCase.fixtures, {
       ...(request.fixturesRoot ? { fixturesRoot: request.fixturesRoot } : {}),
       casePath,
-      artifactsDir: this.runDir.artifactsDir,
+      artifactsDir: this.workspace.path,
     });
     this.fixturesHash = staged?.hash;
     if (request.abortSignal?.aborted) return;
@@ -387,7 +390,7 @@ class RunExecution implements RunLifecycleEffects<RunResult> {
       ...(this.args.fixtureValues.length > 0 ? { fixtureValues: this.args.fixtureValues } : {}),
       runsRoot: resolve(request.runsRoot),
       runDir: this.runDir.path,
-      artifactsDir: this.runDir.artifactsDir,
+      artifactsDir: this.workspace.path,
       abortSignal: request.abortSignal ?? new AbortController().signal,
     });
     this.append({ type: "ready", ...this.ready });
@@ -463,6 +466,12 @@ class RunExecution implements RunLifecycleEffects<RunResult> {
   }
 
   async close(primaryError: unknown | null): Promise<void> {
+    if (this.workspace) {
+      await closeQuietly(async () => {
+        await this.args.driver.close();
+        await this.workspace?.archive(this.runDir.artifactsDir);
+      }, `run workspace ${this.workspace.path}`);
+    }
     if (primaryError instanceof Error) {
       (primaryError as Error & RunDirCarrier).luxRunDir = this.runDir.path;
     }
@@ -567,7 +576,11 @@ class RunExecution implements RunLifecycleEffects<RunResult> {
     if (!this.ready) return { artifacts: [] };
     try {
       await this.args.driver.quiesce?.();
-      return { artifacts: await this.args.driver.collect() };
+      const artifacts = await this.args.driver.collect();
+      return {
+        artifacts:
+          (await this.workspace?.archive(this.runDir.artifactsDir, artifacts)) ?? artifacts,
+      };
     } catch (error) {
       const reason = errorMessage(error);
       this.runDir.events.append({

package/src/orchestrator/run-workspace.ts

@@ -0,0 +1,62 @@
+import { cp, lstat, mkdir, mkdtemp, realpath, rename, rm, rmdir } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import type { Artifact } from "../core/index.js";
+
+/** Keep package-manager discovery and repository ignore rules outside subject workspaces. */
+export class RunWorkspace {
+  private archived = false;
+  readonly path: string;
+
+  private constructor(path: string) {
+    this.path = path;
+  }
+
+  static async create(): Promise<RunWorkspace> {
+    const root = join(tmpdir(), `lux-workspaces-${process.getuid?.() ?? "user"}`);
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const metadata = await lstat(root);
+    if (
+      !metadata.isDirectory() ||
+      metadata.isSymbolicLink() ||
+      (process.getuid && metadata.uid !== process.getuid())
+    ) {
+      throw new Error(
+        `Lux workspace root must be a real directory owned by the current user: ${root}`,
+      );
+    }
+    return new RunWorkspace(await realpath(await mkdtemp(join(root, "run-"))));
+  }
+
+  async archive(destination: string, artifacts: Artifact[] = []): Promise<Artifact[]> {
+    if (!this.archived) {
+      const metadata = await lstat(this.path);
+      if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+        throw new Error(`run workspace must remain a real directory: ${this.path}`);
+      }
+      await rmdir(destination).catch((error: NodeJS.ErrnoException) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+      try {
+        await rename(this.path, destination);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== "EXDEV") throw error;
+        await cp(this.path, destination, { recursive: true, verbatimSymlinks: true });
+        await rm(this.path, { recursive: true });
+      }
+      this.archived = true;
+    }
+    return artifacts.map((artifact) => {
+      if (!artifact.root) return artifact;
+      const path = relative(this.path, resolve(artifact.root));
+      if (path === "") {
+        const { root: _root, ...captured } = artifact;
+        return captured;
+      }
+      if (path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) {
+        return artifact;
+      }
+      return { ...artifact, root: join(destination, path) };
+    });
+  }
+}