@xfey/tutti 0.1.5 → 0.1.6

package/dist/providers/openai/app-server/read-only-procedure.js

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { buildCodexAppServerProcessPlan } from "../codex-app-server.js";
 import { DEFAULT_OPENAI_MODEL } from "../model-config.js";
 import { CodexAppServerJsonRpcClient, CodexAppServerProtocolError, } from "./json-rpc.js";
-import { createReadOnlyPermissionProfile } from "./permission-profile.js";
+import { createReadOnlySandboxPolicy } from "./sandbox-policy.js";
 import { buildCodexAppServerProviderConfigOverrides, resolveCodexAppServerModelProvider, } from "./provider-config.js";
 import { buildCodexAppServerTurnInput, resolveCodexAppServerContextRuntimeHint, resolveCodexAppServerSkillInputs, CodexAppServerSkillSelectionError, } from "./skills.js";
 import { containsKnownSecret, createCodexSpawnEnv, extractAgentText, extractServerRequestMethod, findJsonObjectCandidates, isApiKeyAccount, readThreadId, readTurnError, readTurnStatus, redactWithKnownValues, compactText, } from "./runtime-helpers.js";
@@ -166,9 +166,7 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
             model,
             modelProvider,
             approvalPolicy: "never",
-            permissionProfile: createReadOnlyPermissionProfile(readablePaths, {
-                networkEnabled,
-            }),
+            sandbox: "read-only",
             config: buildReadOnlyThreadConfig(options),
             ephemeral: true,
             experimentalRawEvents: false,
@@ -189,7 +187,7 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
             }),
             cwd: appServerCwd,
             approvalPolicy: "never",
-            permissionProfile: createReadOnlyPermissionProfile(readablePaths, {
+            sandboxPolicy: createReadOnlySandboxPolicy({
                 networkEnabled,
             }),
             model,

package/dist/providers/openai/app-server/sandbox-policy.d.ts

@@ -0,0 +1,18 @@
+export type ReadOnlySandboxPolicyOptions = {
+    networkEnabled?: boolean;
+};
+export type WorkspaceWriteSandboxPolicyOptions = {
+    networkEnabled?: boolean;
+};
+export declare function createReadOnlySandboxPolicy(options?: ReadOnlySandboxPolicyOptions): {
+    type: "readOnly";
+    networkAccess: boolean;
+};
+export declare function createWorkspaceWriteSandboxPolicy(writableRoot: string, options?: WorkspaceWriteSandboxPolicyOptions): {
+    type: "workspaceWrite";
+    writableRoots: string[];
+    networkAccess: boolean;
+    excludeTmpdirEnvVar: boolean;
+    excludeSlashTmp: boolean;
+};
+//# sourceMappingURL=sandbox-policy.d.ts.map

package/dist/providers/openai/app-server/sandbox-policy.js

@@ -0,0 +1,16 @@
+export function createReadOnlySandboxPolicy(options = {}) {
+    return {
+        type: "readOnly",
+        networkAccess: options.networkEnabled ?? true,
+    };
+}
+export function createWorkspaceWriteSandboxPolicy(writableRoot, options = {}) {
+    return {
+        type: "workspaceWrite",
+        writableRoots: [writableRoot],
+        networkAccess: options.networkEnabled ?? true,
+        excludeTmpdirEnvVar: false,
+        excludeSlashTmp: false,
+    };
+}
+//# sourceMappingURL=sandbox-policy.js.map

package/dist/providers/openai/app-server/smoke.js

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { CODEX_APP_SERVER_COMMAND, CODEX_APP_SERVER_LISTEN_URL, buildCodexAppServerProcessPlan, } from "../codex-app-server.js";
 import { DEFAULT_OPENAI_MODEL } from "../model-config.js";
 import { CodexAppServerJsonRpcClient, CodexAppServerProtocolError, } from "./json-rpc.js";
-import { createReadOnlyPermissionProfile } from "./permission-profile.js";
+import { createReadOnlySandboxPolicy } from "./sandbox-policy.js";
 import { buildCodexAppServerProviderConfigOverrides, resolveCodexAppServerModelProvider, } from "./provider-config.js";
 import { containsKnownSecret, countAvailableModels, createCodexSpawnEnv, createSmokeRepo, extractAgentText, extractNotificationMethod, isApiKeyAccount, modelListContains, readAccountType, readGitStatus, readThreadId, readTurnStatus, redactWithKnownValues, renderNoWriteSmokePrompt, } from "./smoke-helpers.js";
 import { resolveCodexAppServerSmokeProviderInput } from "./smoke-provider-input.js";
@@ -68,7 +68,7 @@ export async function runCodexAppServerNoWriteSmoke(options) {
             model,
             modelProvider,
             approvalPolicy: "never",
-            permissionProfile: createReadOnlyPermissionProfile(repoRoot),
+            sandbox: "read-only",
             ephemeral: true,
             experimentalRawEvents: false,
             persistExtendedHistory: false,
@@ -88,7 +88,7 @@ export async function runCodexAppServerNoWriteSmoke(options) {
             ],
             cwd: repoRoot,
             approvalPolicy: "never",
-            permissionProfile: createReadOnlyPermissionProfile(repoRoot),
+            sandboxPolicy: createReadOnlySandboxPolicy(),
             model,
             modelProvider,
             outputSchema: CODEX_APP_SERVER_READ_ONLY_SMOKE_OUTPUT_SCHEMA,

package/dist/providers/openai/app-server/workspace-write-run.js

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { buildCodexAppServerProcessPlan } from "../codex-app-server.js";
 import { DEFAULT_OPENAI_MODEL } from "../model-config.js";
 import { CodexAppServerJsonRpcClient, CodexAppServerProtocolError, } from "./json-rpc.js";
-import { createWorkspaceWritePermissionProfile } from "./permission-profile.js";
+import { createWorkspaceWriteSandboxPolicy } from "./sandbox-policy.js";
 import { buildCodexAppServerProviderConfigOverrides, resolveCodexAppServerModelProvider, } from "./provider-config.js";
 import { buildCodexAppServerTurnInput, resolveCodexAppServerContextRuntimeHint, resolveCodexAppServerSkillsListWarmup, resolveCodexAppServerSkillInputs, CodexAppServerSkillSelectionError, } from "./skills.js";
 import { compactText, containsKnownSecret, createCodexSpawnEnv, extractAgentText, extractServerRequestMethod, findJsonObjectCandidates, isApiKeyAccount, readThreadId, readTurnError, readTurnStatus, redactWithKnownValues, } from "./runtime-helpers.js";
@@ -248,9 +248,7 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
             modelProvider,
             approvalPolicy,
             approvalsReviewer,
-            permissionProfile: createWorkspaceWritePermissionProfile(options.workspaceRoot, {
-                networkEnabled,
-            }),
+            sandbox: "workspace-write",
             config: buildWorkspaceWriteThreadConfig(options),
             ephemeral: true,
             experimentalRawEvents: false,
@@ -272,7 +270,7 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
             cwd: options.workspaceRoot,
             approvalPolicy,
             approvalsReviewer,
-            permissionProfile: createWorkspaceWritePermissionProfile(options.workspaceRoot, {
+            sandboxPolicy: createWorkspaceWriteSandboxPolicy(options.workspaceRoot, {
                 networkEnabled,
             }),
             model,

package/dist/providers/openai/codex-app-server.d.ts

@@ -43,21 +43,12 @@ export type CodexAppServerThreadStartParams = {
     experimentalRawEvents: false;
     persistExtendedHistory: false;
 };
-export type CodexAppServerReadOnlyAccess = {
-    type: "restricted";
-    includePlatformDefaults: boolean;
-    readableRoots: string[];
-} | {
-    type: "fullAccess";
-};
 export type CodexAppServerSandboxPolicy = {
     type: "readOnly";
-    access: CodexAppServerReadOnlyAccess;
     networkAccess: boolean;
 } | {
     type: "workspaceWrite";
     writableRoots: string[];
-    readOnlyAccess: CodexAppServerReadOnlyAccess;
     networkAccess: boolean;
     excludeTmpdirEnvVar: boolean;
     excludeSlashTmp: boolean;

package/dist/providers/openai/codex-app-server.js

@@ -107,11 +107,6 @@ export function createCodexAppServerNoWriteSmokePlan(options) {
                 approvalPolicy: "never",
                 sandboxPolicy: {
                     type: "readOnly",
-                    access: {
-                        type: "restricted",
-                        includePlatformDefaults: true,
-                        readableRoots: [options.workingDirectory],
-                    },
                     networkAccess,
                 },
                 outputSchema: CODEX_NO_WRITE_SMOKE_OUTPUT_SCHEMA,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/providers/openai/app-server/permission-profile.d.ts

@@ -1,64 +0,0 @@
-export type ReadOnlyPermissionProfileOptions = {
-    networkEnabled?: boolean;
-};
-export type WorkspaceWritePermissionProfileOptions = {
-    networkEnabled?: boolean;
-};
-export declare function createReadOnlyPermissionProfile(readablePaths: string | string[], options?: ReadOnlyPermissionProfileOptions): {
-    type: "managed";
-    network: {
-        enabled: boolean;
-    };
-    fileSystem: {
-        type: "restricted";
-        entries: ({
-            access: "read";
-            path: {
-                type: "path";
-                path: string;
-            };
-        } | {
-            access: "read";
-            path: {
-                type: "special";
-                value: {
-                    kind: "minimal";
-                };
-            };
-        })[];
-    };
-};
-export declare function createWorkspaceWritePermissionProfile(writableRoot: string, options?: WorkspaceWritePermissionProfileOptions): {
-    type: "managed";
-    network: {
-        enabled: boolean;
-    };
-    fileSystem: {
-        type: "restricted";
-        entries: ({
-            access: "read";
-            path: {
-                type: "special";
-                value: {
-                    kind: "minimal";
-                };
-                path?: never;
-            };
-        } | {
-            access: "read";
-            path: {
-                type: "path";
-                path: string;
-                value?: never;
-            };
-        } | {
-            access: "write";
-            path: {
-                type: "path";
-                path: string;
-                value?: never;
-            };
-        })[];
-    };
-};
-//# sourceMappingURL=permission-profile.d.ts.map

package/dist/providers/openai/app-server/permission-profile.js

@@ -1,67 +0,0 @@
-export function createReadOnlyPermissionProfile(readablePaths, options = {}) {
-    const paths = Array.isArray(readablePaths) ? readablePaths : [readablePaths];
-    return {
-        type: "managed",
-        network: {
-            enabled: options.networkEnabled ?? true,
-        },
-        fileSystem: {
-            type: "restricted",
-            entries: [
-                {
-                    access: "read",
-                    path: {
-                        type: "special",
-                        value: {
-                            kind: "minimal",
-                        },
-                    },
-                },
-                ...[...new Set(paths)].map((path) => ({
-                    access: "read",
-                    path: {
-                        type: "path",
-                        path,
-                    },
-                })),
-            ],
-        },
-    };
-}
-export function createWorkspaceWritePermissionProfile(writableRoot, options = {}) {
-    return {
-        type: "managed",
-        network: {
-            enabled: options.networkEnabled ?? true,
-        },
-        fileSystem: {
-            type: "restricted",
-            entries: [
-                {
-                    access: "read",
-                    path: {
-                        type: "special",
-                        value: {
-                            kind: "minimal",
-                        },
-                    },
-                },
-                {
-                    access: "read",
-                    path: {
-                        type: "path",
-                        path: writableRoot,
-                    },
-                },
-                {
-                    access: "write",
-                    path: {
-                        type: "path",
-                        path: writableRoot,
-                    },
-                },
-            ],
-        },
-    };
-}
-//# sourceMappingURL=permission-profile.js.map