@pulsehub/runner 0.1.9 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulsehub/runner",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Local, credential-safe Pulse Runner",
   "repository": {
     "type": "git",

package/src/process.js

@@ -83,10 +83,15 @@ async function mcpConfig(dir, credential, endpoint) {
 }
 
 export function providerInvocation(kind, worktree, additionalDirs, config, mcp, prompt, mode = 'task') {
-  if (kind === 'codex') return {
-    executable: resolveExecutable('codex'),
-    args: ['exec', '--ephemeral', ...agentPermissionArgs(kind, mode), '--cd', worktree, ...additionalDirs, '-c', `mcp_servers.pulse.url=${JSON.stringify(mcpEndpoint(config.endpoint))}`, '-c', 'mcp_servers.pulse.env_http_headers={Authorization="PULSE_RUNNER_MCP_CREDENTIAL"}', prompt],
-  };
+  if (kind === 'codex') {
+    const reviewArgs = mode === 'review'
+      ? ['--skip-git-repo-check', '-c', 'mcp_servers.pulse.default_tools_approval_mode="approve"']
+      : [];
+    return {
+      executable: resolveExecutable('codex'),
+      args: ['exec', '--ephemeral', ...agentPermissionArgs(kind, mode), ...reviewArgs, '--cd', worktree, ...additionalDirs, '-c', `mcp_servers.pulse.url=${JSON.stringify(mcpEndpoint(config.endpoint))}`, '-c', 'mcp_servers.pulse.env_http_headers={Authorization="PULSE_RUNNER_MCP_CREDENTIAL"}', prompt],
+    };
+  }
   if (kind === 'claude') return {
     executable: resolveExecutable('claude'),
     args: ['--print', '--no-session-persistence', ...agentPermissionArgs(kind, mode), ...additionalDirs, '--strict-mcp-config', '--mcp-config', mcp, prompt],

package/test/process.test.js

@@ -1,12 +1,25 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { agentPermissionArgs, mcpEndpoint } from '../src/process.js';
+import { agentPermissionArgs, mcpEndpoint, providerInvocation } from '../src/process.js';
 
 test('QA Runner sessions use read-only filesystem permissions', () => {
   assert.deepEqual(agentPermissionArgs('codex', 'review'), ['--sandbox', 'read-only']);
   assert.deepEqual(agentPermissionArgs('claude', 'review'), ['--permission-mode', 'plan']);
 });
 
+test('Codex QA starts outside the snapshots without trusting the repository or widening sandbox access', () => {
+  const invocation = providerInvocation('codex', '/tmp/pulse-review', ['/tmp/snapshot'], { endpoint: 'https://example.cloudfunctions.net/pulseRunnerPoll' }, '/tmp/pulse-mcp.json', 'Review', 'review');
+  assert(invocation.args.includes('--skip-git-repo-check'));
+  assert.deepEqual(agentPermissionArgs('codex', 'review'), ['--sandbox', 'read-only']);
+  assert(invocation.args.includes('mcp_servers.pulse.default_tools_approval_mode="approve"'));
+  assert(!invocation.args.includes('--ask-for-approval'));
+});
+
+test('Codex development jobs do not auto-approve MCP tools', () => {
+  const invocation = providerInvocation('codex', '/tmp/pulse-task', [], { endpoint: 'https://example.cloudfunctions.net' }, '/tmp/pulse-mcp.json', 'Task', 'task');
+  assert(!invocation.args.some((arg) => arg.includes('default_tools_approval_mode')));
+});
+
 test('development jobs retain their configured write permissions', () => {
   assert.deepEqual(agentPermissionArgs('codex', 'task'), ['--approve-for-me']);
   assert.deepEqual(agentPermissionArgs('claude', 'task'), ['--permission-mode', 'bypassPermissions', '--dangerously-skip-permissions']);