@sweny-ai/core 0.1.154 → 0.1.156

package/dist/harness/capabilities.d.ts

@@ -22,8 +22,11 @@ export declare const CLAUDE_CODE_CAPABILITIES: HarnessCapabilities;
  *   is not trusted in that ignored file (config/src/loader/mod.rs).
  * - sandbox fs only: `--sandbox read-only|workspace-write`. Network is one
  *   on/off switch (`sandbox_workspace_write.network_access`), not a host list.
- * - readOnly native: `--sandbox read-only` plus the shell, web search and
- *   subagent switches above.
+ * - readOnly native: `--sandbox read-only` plus the web search and subagent
+ *   switches above. The shell stays: Codex has no other way to read a file, and
+ *   the OS sandbox (SandboxPolicy::ReadOnly, network off by default,
+ *   protocol/src/protocol.rs) blocks writes and network from it. An explicit
+ *   `tools.deny: [shell]` still removes it.
  * - turnLimit watchdog: codex exec has no turn limit; sweny counts tool calls.
  * - usage tokens only: `turn.completed.usage`; Codex reports no cost.
  */

package/dist/harness/capabilities.js

@@ -32,8 +32,11 @@ export const CLAUDE_CODE_CAPABILITIES = {
  *   is not trusted in that ignored file (config/src/loader/mod.rs).
  * - sandbox fs only: `--sandbox read-only|workspace-write`. Network is one
  *   on/off switch (`sandbox_workspace_write.network_access`), not a host list.
- * - readOnly native: `--sandbox read-only` plus the shell, web search and
- *   subagent switches above.
+ * - readOnly native: `--sandbox read-only` plus the web search and subagent
+ *   switches above. The shell stays: Codex has no other way to read a file, and
+ *   the OS sandbox (SandboxPolicy::ReadOnly, network off by default,
+ *   protocol/src/protocol.rs) blocks writes and network from it. An explicit
+ *   `tools.deny: [shell]` still removes it.
  * - turnLimit watchdog: codex exec has no turn limit; sweny counts tool calls.
  * - usage tokens only: `turn.completed.usage`; Codex reports no cost.
  */

package/dist/harness/codex.js

@@ -744,8 +744,19 @@ export class CodexHarness {
         }
         const readOnly = policy.readOnly;
         const deny = new Set(policy.deny);
+        // Read-only keeps the shell. Codex has no non-shell way to read a file
+        // (apply_patch only writes), so dropping it left read-only nodes (triage
+        // gather/investigate, implement analyze, drift inventory) blind. The shell
+        // is safe here because `--sandbox read-only` is enforced by the OS, not by
+        // the model: it maps to SandboxPolicy::ReadOnly { network_access: false },
+        // "read-only access ... outbound network ... false by default"
+        // (openai/codex rust-v0.159.2, codex-rs/protocol/src/protocol.rs, the
+        // SandboxPolicy enum ~L1079 and new_read_only_policy ~L1205). So a shell
+        // command can read the checkout but cannot write files or reach the
+        // network. Network and subagents are still denied at the tool level, and an
+        // explicit `tools.deny: [shell]` (already in policy.deny) still removes it.
         if (readOnly)
-            for (const c of ["shell", "net", "subagent"])
+            for (const c of ["net", "subagent"])
                 deny.add(c);
         let sandbox = "read-only";
         if (!readOnly) {

package/dist/schema.d.ts

@@ -3405,7 +3405,7 @@ export declare const workflowJsonSchema: {
             }];
         };
         readonly Permissions: {
-            readonly description: "What a node's agent may do. 'read' runs it read-only: only access: read skill tools, no external skill MCP servers, no shell, file-write, edit, fetch or subagent built-ins. On the workflow it is the default and the ceiling for every node.";
+            readonly description: "What a node's agent may do. 'read' runs it read-only: only access: read skill tools, no external skill MCP servers, no file-write, edit, fetch or subagent built-ins, and no shell (on Codex, a shell confined to its OS read-only sandbox). On the workflow it is the default and the ceiling for every node.";
             readonly oneOf: readonly [{
                 readonly type: "string";
                 readonly enum: readonly ["read", "write"];

package/dist/schema.js

@@ -820,7 +820,7 @@ export const workflowJsonSchema = {
             ],
         },
         Permissions: {
-            description: "What a node's agent may do. 'read' runs it read-only: only access: read skill tools, no external skill MCP servers, no shell, file-write, edit, fetch or subagent built-ins. On the workflow it is the default and the ceiling for every node.",
+            description: "What a node's agent may do. 'read' runs it read-only: only access: read skill tools, no external skill MCP servers, no file-write, edit, fetch or subagent built-ins, and no shell (on Codex, a shell confined to its OS read-only sandbox). On the workflow it is the default and the ceiling for every node.",
             oneOf: [
                 { type: "string", enum: [...NODE_ACCESS] },
                 {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.154",
+  "version": "0.1.156",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"