@wix/pathgrade 1.0.13 → 1.0.14

package/README.md

@@ -47,6 +47,8 @@ By default, Pathgrade tries to reuse the agent CLI's native auth before falling
 
 If you set `ANTHROPIC_BASE_URL`, `OPENAI_BASE_URL`, or `CURSOR_API_BASE_URL`, set the matching API key too.
 
+Do not add `copyFromHome: ['.codex']` just to reuse Codex authentication. When no OpenAI API key is available, Pathgrade automatically stages only `~/.codex/auth.json`. A deliberate full `.codex` copy remains supported, but it also imports host config, MCP definitions, plugins, caches, sessions, and other potentially large or sensitive state; Pathgrade prints a warning when requested.
+
 Override credentials per test with `env`:
 
 ```typescript

package/dist/providers/sandbox.js

@@ -6,6 +6,9 @@ import { createSandboxRoot } from './sandbox-lifecycle.js';
 export const SAFE_HOST_VARS = [
     'PATH', 'SHELL', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM', 'USER', 'LOGNAME',
 ];
+function copiesEntireCodexHome(relPath) {
+    return path.posix.normalize(relPath.replace(/\\/g, '/')).replace(/\/+$/, '') === '.codex';
+}
 export async function createSandbox(spec) {
     const rootDir = await createSandboxRoot();
     const workspacePath = path.join(rootDir, 'workspace');
@@ -51,6 +54,9 @@ export async function createSandbox(spec) {
     }
     // Copy specified paths from real host HOME into sandbox HOME
     if (spec.copyFromHome) {
+        if (spec.copyFromHome.some(copiesEntireCodexHome)) {
+            console.warn('pathgrade: copyFromHome requests a copy of the entire ~/.codex directory, including config, MCP definitions, plugins, caches, sessions, and other potentially large or sensitive state. Pathgrade stages ~/.codex/auth.json automatically when cached Codex auth is needed; keep the full copy only when reproducing the host Codex environment intentionally.');
+        }
         const realHome = os.homedir();
         for (const relPath of spec.copyFromHome) {
             const srcPath = path.join(realHome, relPath);

package/dist/sdk/managed-session.js

@@ -55,7 +55,8 @@ export function createManagedSession(deps) {
                 // Run auth setup commands before first agent turn
                 if (!setupDone) {
                     for (const cmd of ws.setupCommands) {
-                        await ws.exec(cmd);
+                        await ws.exec(cmd, { signal });
+                        signal.throwIfAborted();
                     }
                     setupDone = true;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/pathgrade",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "packageManager": "yarn@4.12.0",
   "description": "Evaluate whether AI agents discover and use your skills correctly",
   "exports": {
@@ -132,5 +132,5 @@
     "typescript": "^5.9.3",
     "zod": "4.3.6"
   },
-  "falconPackageHash": "b327de99650979dcf1db770211744d11c34f2555b5f0b82869b80d30"
+  "falconPackageHash": "211e0bfa59510a8dc93d2458e37199173ed9fe85334473a0e38a0e86"
 }