@sweny-ai/core 0.1.153 → 0.1.155

package/dist/harness/acp.js

@@ -727,6 +727,9 @@ export class AcpHarness {
                     tools: req.tools,
                     context: this.defaultContext,
                     logger: this.logger,
+                    // Wrapped, the shim cannot open the unix socket (srt blocks AF_UNIX on
+                    // Linux); it tunnels to a loopback port through the sandbox proxy (#439).
+                    tcp: wrapper !== undefined,
                     ...(this.toolBridgeShim ? { shimCommand: this.toolBridgeShim } : {}),
                 });
                 // The token rides in the shim's own env entry of session/new, never in argv.
@@ -762,7 +765,8 @@ export class AcpHarness {
                 policy,
                 spawn: { command: this.agent.command, args: this.agent.args, env, cwd: this.cwd },
                 wrapper: wrapper ?? null,
-                harnessEgress: this.egress,
+                // The bridge's loopback endpoint (wrapped runs only): the one extra host the shim needs.
+                harnessEgress: [...this.egress, ...(bridge?.egress ?? [])],
                 env: process.env,
             });
             degraded = prep.degraded;

package/dist/harness/capabilities.d.ts

@@ -22,8 +22,11 @@ export declare const CLAUDE_CODE_CAPABILITIES: HarnessCapabilities;
  *   is not trusted in that ignored file (config/src/loader/mod.rs).
  * - sandbox fs only: `--sandbox read-only|workspace-write`. Network is one
  *   on/off switch (`sandbox_workspace_write.network_access`), not a host list.
- * - readOnly native: `--sandbox read-only` plus the shell, web search and
- *   subagent switches above.
+ * - readOnly native: `--sandbox read-only` plus the web search and subagent
+ *   switches above. The shell stays: Codex has no other way to read a file, and
+ *   the OS sandbox (SandboxPolicy::ReadOnly, network off by default,
+ *   protocol/src/protocol.rs) blocks writes and network from it. An explicit
+ *   `tools.deny: [shell]` still removes it.
  * - turnLimit watchdog: codex exec has no turn limit; sweny counts tool calls.
  * - usage tokens only: `turn.completed.usage`; Codex reports no cost.
  */

package/dist/harness/capabilities.js

@@ -32,8 +32,11 @@ export const CLAUDE_CODE_CAPABILITIES = {
  *   is not trusted in that ignored file (config/src/loader/mod.rs).
  * - sandbox fs only: `--sandbox read-only|workspace-write`. Network is one
  *   on/off switch (`sandbox_workspace_write.network_access`), not a host list.
- * - readOnly native: `--sandbox read-only` plus the shell, web search and
- *   subagent switches above.
+ * - readOnly native: `--sandbox read-only` plus the web search and subagent
+ *   switches above. The shell stays: Codex has no other way to read a file, and
+ *   the OS sandbox (SandboxPolicy::ReadOnly, network off by default,
+ *   protocol/src/protocol.rs) blocks writes and network from it. An explicit
+ *   `tools.deny: [shell]` still removes it.
  * - turnLimit watchdog: codex exec has no turn limit; sweny counts tool calls.
  * - usage tokens only: `turn.completed.usage`; Codex reports no cost.
  */

package/dist/harness/codex.js

@@ -744,8 +744,19 @@ export class CodexHarness {
         }
         const readOnly = policy.readOnly;
         const deny = new Set(policy.deny);
+        // Read-only keeps the shell. Codex has no non-shell way to read a file
+        // (apply_patch only writes), so dropping it left read-only nodes (triage
+        // gather/investigate, implement analyze, drift inventory) blind. The shell
+        // is safe here because `--sandbox read-only` is enforced by the OS, not by
+        // the model: it maps to SandboxPolicy::ReadOnly { network_access: false },
+        // "read-only access ... outbound network ... false by default"
+        // (openai/codex rust-v0.159.2, codex-rs/protocol/src/protocol.rs, the
+        // SandboxPolicy enum ~L1079 and new_read_only_policy ~L1205). So a shell
+        // command can read the checkout but cannot write files or reach the
+        // network. Network and subagents are still denied at the tool level, and an
+        // explicit `tools.deny: [shell]` (already in policy.deny) still removes it.
         if (readOnly)
-            for (const c of ["shell", "net", "subagent"])
+            for (const c of ["net", "subagent"])
                 deny.add(c);
         let sandbox = "read-only";
         if (!readOnly) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.153",
+  "version": "0.1.155",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"