@slopus/happy-agent-supervisor 0.0.2-linux-x64 → 0.0.3-darwin-arm64

package/README.md

@@ -7,7 +7,7 @@ an argument vector; it applies the operating system's own isolation and then
 
 ```text
 caller
-  │ policy JSON on fd or file
+  │ policy JSON argument or trusted file
   │ argv after --
   ▼
 supervisor
@@ -68,7 +68,7 @@ package explicitly and read its path from your build script:
 
 ```sh
 # The binary you want to copy into a linux/amd64 image.
-npm install --no-save @slopus/happy-agent-supervisor@0.0.2-linux-x64
+npm install --no-save @slopus/happy-agent-supervisor@0.0.3-linux-x64
 ```
 
 Or ask your package manager for every variant at once, which is what a release
@@ -76,8 +76,8 @@ pipeline usually wants:
 
 ```sh
 npm install --force \
-  @slopus/happy-agent-supervisor@0.0.2-linux-x64 \
-  @slopus/happy-agent-supervisor@0.0.2-linux-arm64
+  @slopus/happy-agent-supervisor@0.0.3-linux-x64 \
+  @slopus/happy-agent-supervisor@0.0.3-linux-arm64
 ```
 
 Then point the container at it:
@@ -104,13 +104,9 @@ const policy = parseSupervisorPolicy({
 
 const child = spawn(
     resolveSupervisorBinary(),
-    ["--policy-fd", "3", "--", "/usr/bin/env", "node", "build.mjs"],
-    {
-        cwd: "/work/project",
-        stdio: ["inherit", "inherit", "inherit", "pipe"],
-    },
+    ["--policy", JSON.stringify(policy), "--", "/usr/bin/env", "node", "build.mjs"],
+    { cwd: "/work/project", stdio: "inherit" },
 );
-child.stdio[3].end(JSON.stringify(policy));
 ```
 
 `parseSupervisorPolicy(value)` validates against the TypeBox schema and throws a
@@ -126,17 +122,17 @@ not installed. If neither is present they throw, naming the package to reinstall
 
 ## Command line
 
-Policy stays out of argv, and the command is always an argument vector:
+Policy and command are ordinary arguments, matching Codex's direct `sandbox-exec -p` invocation:
 
 ```sh
-happy-agent-supervisor --policy-fd 3 -- /bin/sh -c 'printf "%s\n" "$VALUE"'
+happy-agent-supervisor --policy '{"mode":"workspace_write","network":{"egress":false,"localBinding":false}}' -- /bin/sh -c 'printf "%s\n" "$VALUE"'
 happy-agent-supervisor --policy-file /trusted/policy.json -- /usr/bin/env
 ```
 
-Exactly one of `--policy-fd` and `--policy-file` is required, and everything
-after `--` is the target command. The supervisor consumes the policy descriptor;
-descriptors `0`, `1`, and `2` are rejected. Policy files are read and closed
-before sandbox setup. Policy JSON is limited to 1 MiB and rejects unknown fields.
+Exactly one of `--policy` and `--policy-file` is required, and everything after `--` is the target
+command. Policy files are read and closed before sandbox setup. Policy JSON is limited to 1 MiB and
+rejects unknown fields. The direct form creates no inherited descriptor beyond ordinary stdin,
+stdout, and stderr.
 A supervisor-level failure — a bad argument, an invalid policy, an enforcement
 step that would not apply — exits `125` with a message on stderr, which keeps it
 distinguishable from the workload's own status. Otherwise the workload's exit

package/SHA256SUMS

@@ -1 +1 @@
-6a2f0eca576f4e79512e3e60fac5afaeb0af640da96d7826331ea17e6af71796  vendor/x86_64-unknown-linux-musl/bin/happy-agent-supervisor
+7632a60e11718a54b1aaef404f994a6e97603ca766d0170d698b14b045c3d129  vendor/aarch64-apple-darwin/bin/happy-agent-supervisor

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@slopus/happy-agent-supervisor",
-  "version": "0.0.2-linux-x64",
-  "description": "Trusted native sandbox boundary for Happy agent workloads. Native binary for linux-x64.",
+  "version": "0.0.3-darwin-arm64",
+  "description": "Trusted native sandbox boundary for Happy agent workloads. Native binary for darwin-arm64.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -12,13 +12,13 @@
     "node": ">=22.19.0"
   },
   "os": [
-    "linux"
+    "darwin"
   ],
   "cpu": [
-    "x64"
+    "arm64"
   ],
   "bin": {
-    "happy-agent-supervisor": "vendor/x86_64-unknown-linux-musl/bin/happy-agent-supervisor"
+    "happy-agent-supervisor": "vendor/aarch64-apple-darwin/bin/happy-agent-supervisor"
   },
   "files": [
     "vendor",