alp-code 0.9.0

package/dist/src/runtime/adapter-files.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRuntimeCommand = resolveRuntimeCommand;
+exports.atomicRuntimeFile = atomicRuntimeFile;
+exports.writeRuntimeContextFiles = writeRuntimeContextFiles;
+exports.taskArguments = taskArguments;
+exports.baseRuntimeEnvironment = baseRuntimeEnvironment;
+exports.compactBridgeEnabled = compactBridgeEnabled;
+exports.runtimeSkillRoots = runtimeSkillRoots;
+exports.hookCommand = hookCommand;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const render_session_context_1 = require("./render-session-context");
+const render_task_input_1 = require("./render-task-input");
+let sequence = 0;
+const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+/**
+ * Resolve a runtime CLI's real command name on PATH. Windows installs of `claude`/`codex`
+ * are `.cmd` from npm, `.exe` from winget/native installers, or anything else PATHEXT
+ * lists — hardcoding `.cmd` misses every non-npm install even though it's on PATH and
+ * working (e.g. this very Claude Code session). Returns null when nothing on PATH matches,
+ * so callers can fall back to a platform-appropriate default for error messages.
+ */
+async function resolveRuntimeCommand(name, platform, env) {
+    const directories = (env.PATH ?? env.Path ?? "").split(node_path_1.delimiter).filter(Boolean);
+    if (platform !== "win32") {
+        for (const directory of directories) {
+            try {
+                await (0, promises_1.access)((0, node_path_1.join)(directory, name));
+                return name;
+            }
+            catch { /* continue */ }
+        }
+        return null;
+    }
+    const extensions = (env.PATHEXT || DEFAULT_PATHEXT).split(";").map((value) => value.trim()).filter(Boolean);
+    for (const directory of directories) {
+        for (const extension of extensions) {
+            const candidate = name + extension;
+            try {
+                await (0, promises_1.access)((0, node_path_1.join)(directory, candidate));
+                return candidate;
+            }
+            catch { /* continue */ }
+        }
+    }
+    return null;
+}
+async function atomicRuntimeFile(path, content) {
+    await (0, promises_1.mkdir)((0, node_path_1.dirname)(path), { recursive: true, mode: 0o700 });
+    const temporary = (0, node_path_1.join)((0, node_path_1.dirname)(path), `.${(0, node_path_1.basename)(path)}.${process.pid}.${++sequence}.tmp`);
+    try {
+        await (0, promises_1.writeFile)(temporary, content, { encoding: "utf8", mode: 0o600 });
+        await (0, promises_1.rename)(temporary, path);
+    }
+    finally {
+        await (0, promises_1.rm)(temporary, { force: true });
+    }
+    return path;
+}
+/**
+ * Writes the two context files every runtime needs, and decides which of them exists.
+ *
+ * Both adapters share this because the split is a property of ALP, not of a harness:
+ * session context describes the agent for the whole session and must never create a turn;
+ * task input *is* a turn, so it exists only where ALP is the one starting the conversation.
+ * Interactive therefore gets no task file at all — there is nothing for an adapter to
+ * accidentally hand to the CLI as a positional prompt.
+ */
+async function writeRuntimeContextFiles(execution, interactive) {
+    const { capsule, policy, artifacts } = execution;
+    const sessionContextFile = await atomicRuntimeFile((0, node_path_1.join)(artifacts.runtimeDirectory, "session-context.md"), (0, render_session_context_1.renderSessionContext)(capsule, policy));
+    const taskText = interactive ? null : (0, render_task_input_1.renderTaskInput)(capsule);
+    const taskFile = taskText === null
+        ? null
+        : await atomicRuntimeFile((0, node_path_1.join)(artifacts.runtimeDirectory, "task.md"), taskText);
+    return Object.freeze({ sessionContextFile, taskFile, taskText });
+}
+/**
+ * The positional argument that turns a task into the session's first turn.
+ *
+ * Empty for an interactive launch. That emptiness is the whole point of the split, so it is
+ * expressed once here rather than repeated as a conditional in each adapter.
+ *
+ * A path is only a task for a role that may open it. `titling` holds no tools at all and
+ * every other role's file reads are ACL-gated, so pointing such a role at `task.md` makes
+ * its first move the one thing it cannot do. It gets the task itself instead — the file is
+ * still written, because it is the artefact of record for the execution.
+ */
+function taskArguments(files, policy) {
+    if (files.taskFile === null || files.taskText === null)
+        return Object.freeze([]);
+    return Object.freeze(policy.allowedTools.includes("Read")
+        ? [`ALP task is in ${files.taskFile}; execute it.`]
+        : [files.taskText]);
+}
+function baseRuntimeEnvironment(capsule, files, artifacts) {
+    return {
+        ALP_ROLE: capsule.role,
+        ALP_DELEGATED_ROLE: capsule.role,
+        ALP_DELEGATION_EXECUTION_ID: capsule.executionId,
+        ALP_DELEGATION_WORKSPACE: capsule.activeWorkspace,
+        // Read by `hooks/session-boot.cjs`. Taking it here rather than in each adapter is what
+        // stops a runtime from being wired up without it and silently falling back to the
+        // static role document, which carries no invariants or policy context.
+        ALP_SESSION_CONTEXT: files.sessionContextFile,
+        // Bound to the capsule's own policy, not read from a file: this is what
+        // `compact-record.cjs` stamps onto every journal line, and what `alp context` checks a
+        // checkpoint against before trusting it (invariant 5).
+        ALP_POLICY_HASH: capsule.policyHash,
+        // Read by `session-boot.cjs` on every SessionStart, `source="compact"` included — the
+        // continuity bridge's reinjection channel (plan §8.6).
+        ALP_CONTINUITY_CONTEXT: artifacts.continuityFile,
+        // Read only by `compact-record.cjs`; unconditional here because the checkpoint and its
+        // rendering exist regardless of `ALP_COMPACT_BRIDGE` — only the PreCompact/PostCompact
+        // hook registration is gated on that flag (see `compactBridgeEnabled`).
+        ALP_COMPACT_EVENTS: artifacts.compactEventsFile,
+    };
+}
+/**
+ * Whether this launch should register the PreCompact/PostCompact hooks. Gated on an
+ * environment variable rather than a runtime capability check: rollback is unsetting one
+ * variable, and Stage 4 of the rollout (plan §18) changes only the default returned here.
+ */
+function compactBridgeEnabled(env) {
+    return env.ALP_COMPACT_BRIDGE === "1";
+}
+function runtimeSkillRoots(env) {
+    const home = env.HOME ?? env.USERPROFILE;
+    const roots = [
+        ...(env.ALP_SKILL_ROOTS ?? "").split(node_path_1.delimiter),
+        env.ALP_REPO_ROOT ? (0, node_path_1.join)(env.ALP_REPO_ROOT, "skills") : "",
+        home ? (0, node_path_1.join)(home, ".agents", "skills") : "",
+        env.CODEX_HOME ? (0, node_path_1.join)(env.CODEX_HOME, "skills") : home ? (0, node_path_1.join)(home, ".codex", "skills") : "",
+        env.CLAUDE_CONFIG_DIR ? (0, node_path_1.join)(env.CLAUDE_CONFIG_DIR, "skills") : home ? (0, node_path_1.join)(home, ".claude", "skills") : "",
+    ].filter(Boolean).map((value) => (0, node_path_1.resolve)(value));
+    return [...new Set(roots)].join(node_path_1.delimiter);
+}
+/**
+ * Quotes for a shell, not for JSON. `JSON.stringify` escapes backslashes, so a Windows
+ * path came out as `C:\\Users\\...` inside the command — tolerated by path resolution,
+ * but wrong, and unreadable in the settings file. Plain double quotes are enough: these
+ * are paths we generate ourselves, and neither Windows nor our layout admits a `"`.
+ */
+function hookCommand(script, nodeExecutable = process.execPath) {
+    return `"${nodeExecutable}" "${script}"`;
+}

package/dist/src/runtime/claude-adapter.js

@@ -0,0 +1,177 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClaudeRuntimeAdapter = void 0;
+const node_path_1 = require("node:path");
+const model_context_1 = require("../agents/model-context");
+const registry_1 = require("../agents/registry");
+const state_paths_1 = require("../state-paths");
+const adapter_files_1 = require("./adapter-files");
+const permission_rules_1 = require("./permission-rules");
+class ClaudeRuntimeAdapter {
+    name = "claude";
+    /**
+     * Measured on Claude Code 2.1.259 (schema, 2026-09-03) and 2.1.240 (live, 2026-09-04):
+     * headless on darwin, and inherited TTY on win32 with `trigger=manual`. Both runs put
+     * reinjection inside the compaction:
+     *
+     *   PreCompact -> SessionStart(source="compact") -> PostCompact
+     *
+     * so `PostCompact` is not a safe place to learn that a compaction finished, and a
+     * `PreCompact` with no `PostCompact` after it is ordinary — one was measured.
+     */
+    compact = Object.freeze({
+        preCompact: true,
+        postCompact: true,
+        sessionStartAfterCompact: true,
+    });
+    platform;
+    env;
+    hooksDirectory;
+    constructor(options = {}) {
+        this.platform = options.platform ?? process.platform;
+        this.env = options.env ?? process.env;
+        this.hooksDirectory = options.hooksDirectory ?? (0, node_path_1.join)(this.env.ALP_REPO_ROOT ?? process.cwd(), "hooks");
+    }
+    /**
+     * Claude Code does not activate its filesystem sandbox on Windows — it reports the
+     * feature gate as off and, because ALP asks for `failIfUnavailable`, refuses to start at
+     * all. Requesting a sandbox that cannot exist turns every delegated execution on Windows
+     * into a startup failure, so the request is made only where it can be honoured. The
+     * read-only guarantee is not dropped with it: `claudePermissions` withdraws `Bash`
+     * instead, since a shell is the only remaining way such a role could write.
+     */
+    sandboxAvailable() {
+        return this.platform !== "win32";
+    }
+    memoryRoot() {
+        return (0, state_paths_1.memoryRoot)(this.env);
+    }
+    async probe() {
+        const resolved = await (0, adapter_files_1.resolveRuntimeCommand)("claude", this.platform, this.env);
+        const command = resolved ?? (this.platform === "win32" ? "claude.cmd" : "claude");
+        return resolved
+            ? { ok: true, runtime: this.name, message: `${command} available` }
+            : { ok: false, runtime: this.name, message: `${command} not found`, remediation: "Install Claude Code and ensure it is on PATH." };
+    }
+    async prepare(input) {
+        const { capsule, policy, artifacts } = input.execution;
+        const capsuleFile = await (0, adapter_files_1.atomicRuntimeFile)((0, node_path_1.join)(artifacts.runtimeDirectory, "identity-capsule.json"), `${JSON.stringify(capsule, null, 2)}\n`);
+        const contextFiles = await (0, adapter_files_1.writeRuntimeContextFiles)(input.execution, input.interactive);
+        const skillRoots = (0, adapter_files_1.runtimeSkillRoots)(this.env);
+        const autoCompactTokens = policy.autoCompactTokens[this.name] ?? (0, model_context_1.defaultAutoCompactTokens)(input.model);
+        const settingsFile = await (0, adapter_files_1.atomicRuntimeFile)((0, node_path_1.join)(artifacts.runtimeDirectory, "claude-settings.json"), `${JSON.stringify({
+            $schema: "https://json.schemastore.org/claude-code-settings.json",
+            alp: {
+                executionId: capsule.executionId,
+                policyHash: capsule.policyHash,
+                capsuleFile,
+                sessionContextFile: contextFiles.sessionContextFile,
+                ...(contextFiles.taskFile === null ? {} : { taskFile: contextFiles.taskFile }),
+            },
+            // Ngưỡng vai khai, hoặc 90% cửa sổ của model khi vai không khai (§5.5). Chỉ vắng
+            // mặt khi ALP cũng không biết cửa sổ của model — lúc đó Claude giữ cửa sổ nó tự
+            // tune. Claude vẫn cap con số này theo cửa sổ context thật của phiên.
+            ...(autoCompactTokens === null ? {} : { autoCompactWindow: autoCompactTokens }),
+            hooks: {
+                SessionStart: [{ hooks: [{ type: "command", command: (0, adapter_files_1.hookCommand)((0, node_path_1.join)(this.hooksDirectory, "session-boot.cjs")) }] }],
+                Stop: [{ hooks: [{ type: "command", command: (0, adapter_files_1.hookCommand)((0, node_path_1.join)(this.hooksDirectory, "session-end.cjs")) }] }],
+                // Gated on the flag (§10) and on the pinned capability — the latter only ever
+                // withholds a registration this build cannot back up with a measured event. No
+                // matcher: the measured `trigger` values are `manual`/`auto` and the bridge wants
+                // both.
+                ...((0, adapter_files_1.compactBridgeEnabled)(this.env) && this.compact.preCompact ? {
+                    PreCompact: [{ hooks: [{ type: "command", command: `${(0, adapter_files_1.hookCommand)((0, node_path_1.join)(this.hooksDirectory, "compact-record.cjs"))} pre claude` }] }],
+                } : {}),
+                ...((0, adapter_files_1.compactBridgeEnabled)(this.env) && this.compact.postCompact ? {
+                    PostCompact: [{ hooks: [{ type: "command", command: `${(0, adapter_files_1.hookCommand)((0, node_path_1.join)(this.hooksDirectory, "compact-record.cjs"))} post claude` }] }],
+                } : {}),
+            },
+            permissions: (0, permission_rules_1.claudePermissions)({
+                policy,
+                memoryRoot: this.memoryRoot(),
+                runtimeDirectory: artifacts.runtimeDirectory,
+                allRoles: registry_1.agentRegistry.list().map((definition) => definition.id),
+                sandboxed: this.sandboxAvailable(),
+            }),
+            ...(policy.workspaceMode === "read-only" && this.sandboxAvailable() ? {
+                sandbox: {
+                    enabled: true,
+                    failIfUnavailable: true,
+                    allowUnsandboxedCommands: false,
+                    filesystem: { denyWrite: [capsule.activeWorkspace] },
+                },
+            } : {}),
+        }, null, 2)}\n`);
+        /**
+         * Written for every execution, granted servers or none.
+         *
+         * The empty file is the point: paired with `--strict-mcp-config` it is what stops a
+         * delegated specialist from inheriting whatever MCP servers happen to be configured on
+         * this machine — egress no policy authorized and the Authority table never named.
+         */
+        const mcpConfigFile = await (0, adapter_files_1.atomicRuntimeFile)((0, node_path_1.join)(artifacts.runtimeDirectory, "mcp-config.json"), `${JSON.stringify({
+            mcpServers: Object.fromEntries(policy.mcpServers.map((server) => [server.name, {
+                    type: "stdio",
+                    command: server.command,
+                    args: [...server.args],
+                    ...(server.env === undefined ? {} : { env: server.env }),
+                }])),
+        }, null, 2)}\n`);
+        const skillRootsFile = await (0, adapter_files_1.atomicRuntimeFile)((0, node_path_1.join)(artifacts.runtimeDirectory, "skill-roots.json"), `${JSON.stringify(skillRoots.split(node_path_1.delimiter).filter(Boolean), null, 2)}\n`);
+        const env = {
+            ...(0, adapter_files_1.baseRuntimeEnvironment)(capsule, contextFiles, artifacts),
+            ALP_EXECUTION_ROOT: (0, node_path_1.dirname)(artifacts.directory),
+            ALP_MEMORY_ROOT: this.memoryRoot(),
+            ALP_IDENTITY_CAPSULE: capsuleFile,
+            ALP_RUNTIME_CONFIG: settingsFile,
+            ALP_SKILL_ROOTS: skillRoots,
+            ALP_MODE: policy.mode,
+            ...(policy.workspaceMode === "read-only" ? { ALP_READONLY_DIRS: capsule.activeWorkspace } : {}),
+        };
+        const command = (await (0, adapter_files_1.resolveRuntimeCommand)("claude", this.platform, this.env))
+            ?? (this.platform === "win32" ? "claude.cmd" : "claude");
+        return Object.freeze({
+            command,
+            args: Object.freeze([
+                "--settings", settingsFile,
+                "--model", input.model,
+                // Fail-closed MCP for a delegated execution. Interactive is the principal's own
+                // session at their own machine config — the same trade-off `--dangerously-skip-
+                // permissions` already makes one line below, and stated here so it is a decision
+                // rather than an omission.
+                "--mcp-config", mcpConfigFile,
+                ...(input.interactive ? [] : ["--strict-mcp-config"]),
+                // Session-scoped subagent definitions (§4.6). No built-in holds a grant, so this is
+                // absent from every launch ALP makes today.
+                ...(policy.subagents.length === 0 ? [] : ["--agents", JSON.stringify(Object.fromEntries(policy.subagents.map((subagent) => [subagent.name, {
+                            description: subagent.description,
+                            prompt: subagent.prompt,
+                            tools: [...subagent.tools],
+                            ...(subagent.model === undefined ? {} : { model: subagent.model.claude }),
+                        }])))]),
+                // Principal ngồi trước phiên interactive và tự duyệt được từng bước, nên prompt quyền chỉ
+                // là ma sát. Đánh đổi phải nói rõ: cờ này vô hiệu hoá `permissions.deny` ở settings trên —
+                // gồm cả cách ly private memory giữa các role, thứ chỉ Claude cưỡng chế được (§ACL trong
+                // permission-rules.ts). Chỉ `alp` (run-main) đặt interactive=true; `alp delegate` luôn
+                // false, nên specialist giữ nguyên sandbox và deny list.
+                ...(input.interactive
+                    ? ["--dangerously-skip-permissions"]
+                    : policy.workspaceMode === "read-only" ? ["--permission-mode", "plan"] : []),
+                // Empty when interactive: the principal's own first message is turn 1. Identity,
+                // invariants and policy have already arrived via the SessionStart hook.
+                ...(0, adapter_files_1.taskArguments)(contextFiles, policy),
+            ]),
+            cwd: capsule.activeWorkspace,
+            env: Object.freeze(env),
+            temporaryFiles: Object.freeze([
+                capsuleFile,
+                contextFiles.sessionContextFile,
+                ...(contextFiles.taskFile === null ? [] : [contextFiles.taskFile]),
+                settingsFile,
+                mcpConfigFile,
+                skillRootsFile,
+            ]),
+        });
+    }
+}
+exports.ClaudeRuntimeAdapter = ClaudeRuntimeAdapter;

package/dist/src/runtime/codex-adapter.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexRuntimeAdapter = void 0;
+const node_path_1 = require("node:path");
+const model_context_1 = require("../agents/model-context");
+const registry_1 = require("../agents/registry");
+const state_paths_1 = require("../state-paths");
+const adapter_files_1 = require("./adapter-files");
+const permission_rules_1 = require("./permission-rules");
+class CodexRuntimeAdapter {
+    name = "codex";
+    /**
+     * Measured on Codex CLI 0.153.0 (schema 2026-09-03; live 2026-09-04 headless on darwin
+     * and win32, and inherited TTY on win32 with `trigger=manual`). Codex reinjects after it
+     * finishes, and only once the next turn begins:
+     *
+     *   PreCompact -> PostCompact -> SessionStart(source="compact")
+     *
+     * measured at 7s past `PostCompact`, which was a human typing. Two earlier sessions
+     * exited straight after compacting, saw no `SessionStart`, and nearly had this pinned
+     * `false`. `manual` and `auto` payloads are identical apart from `trigger`.
+     */
+    compact = Object.freeze({
+        preCompact: true,
+        postCompact: true,
+        sessionStartAfterCompact: true,
+    });
+    platform;
+    env;
+    hooksDirectory;
+    constructor(options = {}) {
+        this.platform = options.platform ?? process.platform;
+        this.env = options.env ?? process.env;
+        this.hooksDirectory = options.hooksDirectory ?? (0, node_path_1.join)(this.env.ALP_REPO_ROOT ?? process.cwd(), "hooks");
+    }
+    memoryRoot() {
+        return (0, state_paths_1.memoryRoot)(this.env);
+    }
+    /**
+     * A hook command Codex can actually run, which on Windows is not the same string Claude
+     * Code needs.
+     *
+     * Codex splits the hook command into argv itself, and the first token may not be quoted:
+     * a command line that *starts with* `"` never resolves an executable. Measured on
+     * `codex-cli 0.153.0` (native `codex.exe`), both `"<node>" "<script>"` and the extra
+     * quote-pair form `""<node>" "<script>""` that v0.3.1 shipped report
+     * `hook: SessionStart Failed`, print nothing and leave the session with no identity —
+     * the pair theory was a `cmd /C` rule Codex turns out not to go through. Quoting the
+     * *later* arguments is fine: `<node> "<script>"` and `node "<script>"` both run, and the
+     * script path stays quoted because it can hold spaces.
+     *
+     * The interpreter therefore goes in bare. `process.execPath` is exact and used as-is when
+     * it has no space; when it does — `C:\Program Files\nodejs\node.exe`, the default install —
+     * the only bare spelling left is `node` off PATH, which the installed `alp.cmd` shim
+     * already depends on. Claude Code must NOT get this treatment: it spawns via
+     * `cmd /d /s /c "<command>"`, where the quoted form is what works today.
+     */
+    hookCommand(script) {
+        const path = (0, node_path_1.join)(this.hooksDirectory, script);
+        if (this.platform !== "win32")
+            return (0, adapter_files_1.hookCommand)(path);
+        const node = process.execPath.includes(" ") ? "node" : process.execPath;
+        return `${node} "${path}"`;
+    }
+    async probe() {
+        const resolved = await (0, adapter_files_1.resolveRuntimeCommand)("codex", this.platform, this.env);
+        const command = resolved ?? (this.platform === "win32" ? "codex.cmd" : "codex");
+        return resolved
+            ? { ok: true, runtime: this.name, message: `${command} available` }
+            : { ok: false, runtime: this.name, message: `${command} not found`, remediation: "Install Codex CLI and ensure it is on PATH." };
+    }
+    async prepare(input) {
+        const { capsule, policy, artifacts } = input.execution;
+        const capsuleFile = await (0, adapter_files_1.atomicRuntimeFile)((0, node_path_1.join)(artifacts.runtimeDirectory, "identity-capsule.json"), `${JSON.stringify(capsule, null, 2)}\n`);
+        const contextFiles = await (0, adapter_files_1.writeRuntimeContextFiles)(input.execution, input.interactive);
+        const skillRoots = (0, adapter_files_1.runtimeSkillRoots)(this.env);
+        const bootCommand = this.hookCommand("session-boot.cjs");
+        const stopCommand = this.hookCommand("session-end.cjs");
+        const bootHooks = `[{ hooks = [{ type = "command", command = ${(0, permission_rules_1.tomlString)(bootCommand)}, timeout = 30 }] }]`;
+        const stopHooks = `[{ hooks = [{ type = "command", command = ${(0, permission_rules_1.tomlString)(stopCommand)}, timeout = 30 }] }]`;
+        // Gated on the flag (§10), same as Claude — only the two events CB-0 measured as firing
+        // on this runtime. `manual` and `auto` were measured identical apart from `trigger`
+        // (plan §Runtime capability), so one registration covers both.
+        const bridgeEnabled = (0, adapter_files_1.compactBridgeEnabled)(this.env);
+        const preCompactCommand = `${this.hookCommand("compact-record.cjs")} pre codex`;
+        const postCompactCommand = `${this.hookCommand("compact-record.cjs")} post codex`;
+        const preCompactHooks = `[{ hooks = [{ type = "command", command = ${(0, permission_rules_1.tomlString)(preCompactCommand)}, timeout = 30 }] }]`;
+        const postCompactHooks = `[{ hooks = [{ type = "command", command = ${(0, permission_rules_1.tomlString)(postCompactCommand)}, timeout = 30 }] }]`;
+        const configFile = await (0, adapter_files_1.atomicRuntimeFile)((0, node_path_1.join)(artifacts.runtimeDirectory, "codex-config.toml"), [
+            `model = ${(0, permission_rules_1.tomlString)(input.model)}`,
+            `model_reasoning_effort = ${(0, permission_rules_1.tomlString)(input.reasoningEffort)}`,
+            `sandbox_mode = ${(0, permission_rules_1.tomlString)(policy.workspaceMode)}`,
+            ...(0, permission_rules_1.codexSandboxLines)({
+                policy,
+                memoryRoot: this.memoryRoot(),
+                allRoles: registry_1.agentRegistry.list().map((definition) => definition.id),
+                // Unused here: Codex's sandbox restricts writes only, so reading the task file is
+                // never in question. Supplied because the grant is part of the shared contract,
+                // and making it optional is what let Claude ship without it.
+                runtimeDirectory: artifacts.runtimeDirectory,
+            }),
+            "[alp]",
+            `execution_id = ${(0, permission_rules_1.tomlString)(capsule.executionId)}`,
+            `capsule = ${(0, permission_rules_1.tomlString)(capsuleFile)}`,
+            `session_context = ${(0, permission_rules_1.tomlString)(contextFiles.sessionContextFile)}`,
+            ...(contextFiles.taskFile === null ? [] : [`task = ${(0, permission_rules_1.tomlString)(contextFiles.taskFile)}`]),
+            "",
+        ].join("\n"));
+        const skillRootsFile = await (0, adapter_files_1.atomicRuntimeFile)((0, node_path_1.join)(artifacts.runtimeDirectory, "skill-roots.json"), `${JSON.stringify(skillRoots.split(node_path_1.delimiter).filter(Boolean), null, 2)}\n`);
+        const autoCompactTokens = policy.autoCompactTokens[this.name] ?? (0, model_context_1.defaultAutoCompactTokens)(input.model);
+        const env = {
+            ...(0, adapter_files_1.baseRuntimeEnvironment)(capsule, contextFiles, artifacts),
+            ALP_EXECUTION_ROOT: (0, node_path_1.dirname)(artifacts.directory),
+            ALP_MEMORY_ROOT: this.memoryRoot(),
+            ALP_IDENTITY_CAPSULE: capsuleFile,
+            ALP_RUNTIME_CONFIG: configFile,
+            ALP_SKILL_ROOTS: skillRoots,
+            ALP_MODE: policy.mode,
+            ...(policy.workspaceMode === "read-only" ? { ALP_READONLY_DIRS: capsule.activeWorkspace } : {}),
+        };
+        const command = (await (0, adapter_files_1.resolveRuntimeCommand)("codex", this.platform, this.env))
+            ?? (this.platform === "win32" ? "codex.cmd" : "codex");
+        return Object.freeze({
+            command,
+            args: Object.freeze([
+                ...(input.interactive ? [] : ["exec", "--skip-git-repo-check"]),
+                "--dangerously-bypass-hook-trust",
+                "--enable", "hooks",
+                "-C", capsule.activeWorkspace,
+                "-m", input.model,
+                "-c", `model_reasoning_effort=${(0, permission_rules_1.tomlString)(input.reasoningEffort)}`,
+                "-c", `hooks.SessionStart=${bootHooks}`,
+                "-c", `hooks.Stop=${stopHooks}`,
+                ...(bridgeEnabled && this.compact.preCompact ? ["-c", `hooks.PreCompact=${preCompactHooks}`] : []),
+                ...(bridgeEnabled && this.compact.postCompact ? ["-c", `hooks.PostCompact=${postCompactHooks}`] : []),
+                // Same reason the hooks ride here: `codex-config.toml` is ALP's file, not the one
+                // Codex loads. Vai không khai thì ALP tự tính 90% cửa sổ model — trùng đúng mặc định
+                // của Codex, nhưng tính ở đây thì Claude cũng nén ở cùng chỗ.
+                ...(autoCompactTokens === null
+                    ? []
+                    : ["-c", `model_auto_compact_token_limit=${autoCompactTokens}`]),
+                // Granted MCP servers. Codex has no in-process subagent, so a `subagents` grant is
+                // simply not translated here — §4.6: subagent là tối ưu hoá, không phải điều kiện.
+                ...(0, permission_rules_1.codexMcpOverrides)(policy),
+                // Đối xứng với `--dangerously-skip-permissions` của Claude: phiên interactive bỏ approval
+                // và sandbox. `-s` bị bỏ đi chứ không để lẫn — Codex không báo lỗi khi có cả hai (chỉ
+                // `--approve-for-me` mới khai `conflicts_with`), cờ bypass thắng và `-s` thành dòng chết
+                // nói sai về chế độ đang chạy. Delegate luôn interactive=false nên vẫn đi nhánh `-s`.
+                ...(input.interactive
+                    ? ["--dangerously-bypass-approvals-and-sandbox"]
+                    : ["-s", policy.workspaceMode]),
+                // Measured on codex-cli 0.149.0: a positional PROMPT becomes a `role: user` message,
+                // i.e. turn 1. Interactive must not have one — identity reaches the model as a
+                // `role: developer` message from the SessionStart hook, ahead of the user's turn.
+                ...(0, adapter_files_1.taskArguments)(contextFiles, policy),
+            ]),
+            cwd: capsule.activeWorkspace,
+            env: Object.freeze(env),
+            temporaryFiles: Object.freeze([
+                capsuleFile,
+                contextFiles.sessionContextFile,
+                ...(contextFiles.taskFile === null ? [] : [contextFiles.taskFile]),
+                configFile,
+                skillRootsFile,
+            ]),
+        });
+    }
+}
+exports.CodexRuntimeAdapter = CodexRuntimeAdapter;

package/dist/src/runtime/permission-rules.js

@@ -0,0 +1,156 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.absoluteRule = absoluteRule;
+exports.claudePermissions = claudePermissions;
+exports.tomlString = tomlString;
+exports.codexSandboxLines = codexSandboxLines;
+exports.codexMcpOverrides = codexMcpOverrides;
+const node_path_1 = require("node:path");
+const types_1 = require("../agents/types");
+/**
+ * Claude Code reads an absolute path in a permission rule as relative to the directory
+ * holding the settings file unless it carries a DOUBLE leading slash. A single slash
+ * silently matches nothing, which disables the rule with no warning at all. Exactly two
+ * is the whole contract, so the path's own leading separator has to go: a POSIX path is
+ * already `/…`, and concatenating it after `//` yields three slashes — a rule that is
+ * just as silently dead as one slash.
+ *
+ * Exported so tests can assert against this format rather than restate it. The one
+ * assertion that did restate it agreed only on Windows, where `C:\…` carries no leading
+ * separator to strip, and so was red on every POSIX machine from the day it was written.
+ */
+function absoluteRule(verb, path) {
+    return `${verb}(//${path.replace(/\\/g, "/").replace(/^\/+/, "")}/**)`;
+}
+function claudePermissions(input) {
+    const { policy } = input;
+    const allow = [
+        ...policy.skills.map((skill) => `Skill(${skill})`),
+        ...policy.subagents.map((subagent) => `Agent(${subagent.name})`),
+        // Whole-server rule: `--strict-mcp-config` already means these are the only servers
+        // connected, so the grant is the server, not each tool it happens to expose.
+        ...policy.mcpServers.map((server) => `mcp__${server.name}`),
+    ];
+    const ownPrivate = (0, node_path_1.join)(input.memoryRoot, "private", policy.role);
+    const additionalDirectories = [
+        // A role with no declared root gets no read grant on the tree it happens to stand in.
+        // The ACL is the enforcement, so listing the workspace here would hand read-thread,
+        // compaction and titling exactly what their own instructions forbid.
+        ...(policy.workspaceAccess === "none" ? [] : [policy.workspace]),
+        input.runtimeDirectory,
+        (0, node_path_1.join)(input.memoryRoot, "shared"),
+        (0, node_path_1.join)(input.memoryRoot, "projects"),
+        ownPrivate,
+    ];
+    // `deny` beats `allow` in Claude Code, and there is no "deny X except Y". Every sibling
+    // must therefore be listed explicitly — a role added without regenerating this list
+    // leaks, because the missing deny line reads as permission.
+    const deny = input.allRoles
+        .filter((role) => role !== policy.role)
+        .flatMap((role) => {
+        const directory = (0, node_path_1.join)(input.memoryRoot, "private", role);
+        return [absoluteRule("Read", directory), absoluteRule("Edit", directory)];
+    });
+    // Tools outside the policy are denied by bare name. Claude Code only honours a path
+    // argument on Read and Edit; on the others a bare name is the only rule that applies.
+    for (const tool of types_1.TOOL_CATALOG) {
+        if (!policy.allowedTools.includes(tool))
+            deny.push(tool);
+    }
+    // The loop above can only deny what ALP itself defines. The runtime's own in-process agent
+    // tool is not in `TOOL_CATALOG` and so was never denied at all — the house rule forbidding
+    // it was prompt text and nothing more. Named explicitly here so the split rule in
+    // `house-rules.ts` is enforced rather than merely stated. No role is granted a subagent
+    // today (§4.6); a definition that can declare one is what will take it off this list.
+    // `Task` is the tool's older name and ALP never grants it under that spelling. `Agent` is
+    // withheld only from a role holding no subagent grant: a bare deny would remove the tool
+    // from the model's context, so a role that *is* granted one gets the narrow `Agent(name)`
+    // allow rules above instead.
+    deny.push("Task");
+    if (policy.subagents.length === 0)
+        deny.push("Agent");
+    // A read-only role keeps that property through two independent mechanisms: no Write/Edit
+    // grant, and a sandbox that denies writes to the workspace. Only the second one stops a
+    // shell redirect, so where no sandbox exists the shell has to go instead. Losing Bash
+    // makes a specialist less capable; losing read-only makes its policy a lie.
+    if (policy.workspaceMode === "read-only" && input.sandboxed === false && !deny.includes("Bash")) {
+        deny.push("Bash");
+    }
+    // Defence in depth: a delegated role must never shell out to a raw runtime, whatever
+    // its tool grant says. Mirrors `src/policy/invariants.ts`.
+    deny.push("Bash(herdr:*)", "Bash(paseo:*)");
+    return {
+        defaultMode: "default",
+        additionalDirectories: Object.freeze(additionalDirectories),
+        allow: Object.freeze(allow),
+        deny: Object.freeze(deny),
+    };
+}
+/**
+ * The single TOML basic-string serializer for everything ALP writes into Codex config.
+ *
+ * `JSON.stringify` is the right primitive rather than a coincidence: TOML basic strings use
+ * the same double-quote delimiter and the same `\"`, `\\`, `\n`, `\t`, `\uXXXX` escapes, so
+ * the output is valid TOML for any input — including Windows paths full of backslashes and
+ * non-ASCII text. It lived in two copies before; keeping one means an escaping bug can only
+ * be fixed once.
+ */
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+function tomlStringArray(values) {
+    return `[${values.map(tomlString).join(", ")}]`;
+}
+/**
+ * Codex config fragment. Returns TOML lines to append to `codex-config.toml`.
+ * `sandbox_mode` is emitted by the adapter itself and is not repeated here.
+ */
+function codexSandboxLines(input) {
+    const { policy } = input;
+    const writableRoots = policy.workspaceMode === "workspace-write"
+        ? [policy.workspace, (0, node_path_1.join)(input.memoryRoot, "private", policy.role)]
+        : [];
+    return Object.freeze([
+        // Nothing in a delegated execution should need an approval prompt: the policy already
+        // decided what is allowed, and a prompt in a background pane just hangs forever.
+        `approval_policy = "never"`,
+        ...(policy.allowedTools.includes("WebSearch") ? [] : [`web_search = "disabled"`]),
+        "",
+        "[sandbox_workspace_write]",
+        `writable_roots = ${tomlStringArray(writableRoots)}`,
+        `network_access = ${policy.allowedTools.includes("WebFetch") || policy.allowedTools.includes("WebSearch")}`,
+        "",
+        // Command-prefix rules are Codex's equivalent of Claude's `Bash(x:*)` deny entries.
+        "[[rules]]",
+        `prefix = ["herdr"]`,
+        "allow = false",
+        "",
+        "[[rules]]",
+        `prefix = ["paseo"]`,
+        "allow = false",
+        "",
+    ]);
+}
+/**
+ * Granted MCP servers as `-c` overrides for Codex.
+ *
+ * They go on argv rather than into `codex-config.toml`, because that file is ALP's own
+ * record — Codex loads `$CODEX_HOME/config.toml`, which ALP does not write — and a server
+ * declared only there would be documentation of a connection that never happened.
+ *
+ * Codex has no `--strict-mcp-config`: whatever the principal configured on the machine
+ * stays connected alongside these. That asymmetry is real and is stated in §4.6 rather than
+ * papered over — the grant adds servers here, where on Claude it also removes them.
+ */
+function codexMcpOverrides(policy) {
+    return Object.freeze(policy.mcpServers.flatMap((server) => {
+        const fields = [
+            `command = ${tomlString(server.command)}`,
+            `args = [${server.args.map(tomlString).join(", ")}]`,
+            ...(server.env === undefined ? [] : [
+                `env = { ${Object.entries(server.env).map(([key, value]) => `${key} = ${tomlString(value)}`).join(", ")} }`,
+            ]),
+        ];
+        return ["-c", `mcp_servers.${server.name}={ ${fields.join(", ")} }`];
+    }));
+}