@xuda.io/ai_module 1.1.5643 → 1.1.5644

package/index.mjs

@@ -253,7 +253,19 @@ const get_openai_codex_exec_args = function (codex_model, opts = {}) {
   // end-user prompts can't run Codex with full host access. The studio/vibe flow
   // passes nothing and keeps the global setting.
   const sandbox = opts.sandbox || _conf.openai_codex_sandbox;
-  const bypass_approvals_and_sandbox = opts.sandbox ? false : typeof _conf.openai_codex_bypass_approvals_and_sandbox === 'undefined' ? true : _conf.openai_codex_bypass_approvals_and_sandbox;
+  // Precedence: an explicit per-call sandbox always confines the run; opts.bypass_sandbox is
+  // the one deliberate escape hatch (the customer-VPS vibe build, which runs on the
+  // customer's OWN box and needs to install and restart things there); otherwise the config
+  // decides. The config default is now false, so a new call site that forgets to say
+  // anything gets a CONFINED run instead of full host access, which is how the mentor Codex
+  // tool ended up unsandboxed.
+  const bypass_approvals_and_sandbox = opts.sandbox
+    ? false
+    : opts.bypass_sandbox === true
+      ? true
+      : typeof _conf.openai_codex_bypass_approvals_and_sandbox === 'undefined'
+        ? true
+        : _conf.openai_codex_bypass_approvals_and_sandbox;
 
   if (codex_model) {
     // codex_model is a catalog code (user pick or cheapest default); the Codex CLI
@@ -1386,6 +1398,9 @@ export const execute_codex_request = async function (req_or_ip, prompt_arg, atta
     // Optional per-call hardening (used by the AI site generator for untrusted
     // prompts): a confined sandbox + a hard wall-clock timeout on the codex run.
     const sandbox = is_req_call ? req_or_ip.sandbox : undefined;
+    // Explicit opt-out of the confined default, for runs that legitimately need full access
+    // on a box the customer owns. Never set this for anything running on Xuda infrastructure.
+    const bypass_sandbox = is_req_call ? req_or_ip.bypass_sandbox === true : false;
     const codex_timeout = is_req_call ? req_or_ip.codex_timeout : undefined;
     // Optional: a scoped MCP server exposed to codex (the in-app vibe's Xuda
     // platform actions). { url, bearer_env_var, bearer_value } — the bearer is
@@ -1594,7 +1609,7 @@ ${prompt}`;
     }
 
     const openai_codex_command = get_openai_codex_cli_command();
-    let codex_args = get_openai_codex_exec_args(codex_model, { sandbox });
+    let codex_args = get_openai_codex_exec_args(codex_model, { sandbox, bypass_sandbox });
     if (agent_mcp && agent_mcp.url) {
       // Register the Xuda MCP server for this run. Global `-c` overrides must
       // precede the `exec` subcommand (args[0]), so prepend them. The bearer
@@ -7037,6 +7052,11 @@ ${conversation_history || `User (dashboard): ${prompt}`}
           prompt: codex_prompt,
           attachments,
           stream: false,
+          // Deliberate: this build runs on the CUSTOMER'S OWN VPS over SSH and has to install
+          // packages, write outside a workspace and restart services there, so it keeps full
+          // access. Stated explicitly now that the global default is confined, so the choice
+          // is visible instead of inherited. Nothing on Xuda infrastructure may set this.
+          bypass_sandbox: true,
           ...(agent_key ? { agent_mcp: { url: 'http://localhost:3012/mcp', bearer_env_var: 'XUDA_AGENT_KEY', bearer_value: agent_key } } : {}),
         },
         job_id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/ai_module",
-  "version": "1.1.5643",
+  "version": "1.1.5644",
   "description": "Xuda AI Module",
   "main": "index.mjs",
   "type": "module",