auxilo-mcp 0.9.21 → 0.9.23

package/bin/auxilo-cli.js

@@ -299,6 +299,8 @@ async function cmdSetup(flags) {
   console.log('');
   try {
     const { binRoot } = installer.installRunner(HOME);
+    const claudeBin = installer.recordClaudeBin(HOME, process.env.PATH);
+    if (claudeBin !== null) console.log(`  ✓ Claude Code CLI recorded: ${claudeBin}`);
     console.log(`  ✓ Extraction runner installed to ${binRoot}`);
   } catch (err) {
     console.error(`  ✗ Runner install failed: ${err.message}`);

package/lib/installer.js

@@ -1061,6 +1061,29 @@ function writeRunnerConfig(homeDir, patch) {
   return merged;
 }
 
+/** Find the first regular executable in PATH, preserving its symlink path. */
+function findExecutableOnPath(name, envPath, fsImpl = fs) {
+  if (typeof envPath !== 'string' || !envPath) return null;
+  for (const dir of envPath.split(path.delimiter)) {
+    if (!dir) continue;
+    const candidate = path.resolve(dir, name);
+    try {
+      if (!fsImpl.statSync(candidate).isFile()) continue;
+      fsImpl.accessSync(candidate, fs.constants.X_OK);
+      return candidate;
+    } catch (_) { /* missing, inaccessible or non-executable — try the next entry */ }
+  }
+  return null;
+}
+
+/** Setup only: record the user's CLI and confirm the best-effort write persisted. */
+function recordClaudeBin(homeDir, envPath, fsImpl = fs) {
+  const bin = findExecutableOnPath('claude', envPath, fsImpl);
+  if (bin === null) return null;
+  writeRunnerConfig(homeDir, { claude_bin: bin });
+  return readRunnerConfig(homeDir).claude_bin === bin ? bin : null;
+}
+
 // ─── Device-code auth (spec §LW-12 step 2; server.js /auth/device) ──────────
 
 /**
@@ -2411,6 +2434,8 @@ module.exports = {
   runnerConfigPath,
   readRunnerConfig,
   writeRunnerConfig,
+  findExecutableOnPath,
+  recordClaudeBin,
   writeEnvFile,
   deviceLogin,
   binRootFor,

package/mcp-server.js

@@ -198,7 +198,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.21' },
+  { name: 'auxilo', version: '0.9.23' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.21",
+  "version": "0.9.23",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",

package/scripts/extract-local.js

@@ -639,6 +639,7 @@ const PRE_SPAWN_SKIP_REASON_CODES = new Set([
   'cli-not-installed',
   'cli-billing-helper-configured',
   'cli-settings-isolation-unsupported',
+  'isolation-precondition',
   'provider-not-configured',
   'providers-file-mode-unsafe',
   'provider-not-installed',

package/scripts/providers/claude-code.js

@@ -22,23 +22,56 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-/** Resolve the `claude` binary — hook/launchd env may have a minimal PATH. */
+/** Leading major.minor.patch only; unreadable versions retain fallback behavior. */
+function versionParts(version) {
+  const match = typeof version === 'string' && /^(\d+)\.(\d+)\.(\d+)/.exec(version);
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function compareVersions(left, right) {
+  for (let i = 0; i < 3; i += 1) {
+    if (left[i] !== right[i]) return left[i] > right[i] ? 1 : -1;
+  }
+  return 0;
+}
+
+/** Resolve the newest readable CLI — hook/launchd env may have a minimal PATH. */
 function resolveClaudeBin(opts = {}) {
   const homeDir = typeof opts.homeDir === 'string' ? opts.homeDir : os.homedir();
   const existsSync = typeof opts.existsSync === 'function' ? opts.existsSync : fs.existsSync;
+  const readFileSyncImpl = typeof opts.readFileSyncImpl === 'function' ? opts.readFileSyncImpl : fs.readFileSync;
   const candidates = [
     path.join(homeDir, '.claude', 'local', 'claude'),
     '/usr/local/bin/claude',
     '/opt/homebrew/bin/claude',
     path.join(homeDir, '.local', 'bin', 'claude'),
+    path.join(homeDir, '.npm-global', 'bin', 'claude'),
   ];
+  // Read directly: the sweeper install does not include lib/installer.js.
+  try {
+    const config = JSON.parse(readFileSyncImpl(path.join(homeDir, '.auxilo', 'runner-config.json'), 'utf8'));
+    const recorded = config && config.claude_bin;
+    if (typeof recorded === 'string' && path.isAbsolute(recorded) && path.basename(recorded) === 'claude') {
+      candidates.unshift(recorded);
+    }
+  } catch (_) { /* missing/malformed config means no recorded candidate */ }
+
+  let firstExisting;
+  let newest;
+  let newestVersion;
   for (const c of candidates) {
     try {
-      if (existsSync(c)) return c;
+      if (!existsSync(c)) continue;
+      if (!firstExisting) firstExisting = c;
+      const version = versionParts(getClaudeCliVersion(c, opts));
+      if (version && (!newestVersion || compareVersions(version, newestVersion) > 0)) {
+        newest = c;
+        newestVersion = version;
+      }
     } catch (_) { /* ignore */ }
   }
   // Absolute launchd fallbacks are absent; let PATH resolve the final option.
-  return 'claude';
+  return newest || firstExisting || 'claude';
 }
 
 // ─── Child settings/hooks isolation (EXTRACTION-CHILD-HOOKS, PUNCH-LIST P1,
@@ -105,27 +138,35 @@ function _resetSettingSourcesCacheForTests() {
   cachedSettingSourcesUnsupported = undefined;
 }
 
-// ─── CLI version, for diagnostics only (no subprocess spawn) ───────────────
+// ─── CLI version, for selection, auth gating and provenance (no spawn) ──────
 //
 // Resolves the installed package's own package.json version by following the
 // resolved binary's real path (e.g. `/usr/local/bin/claude` -> `.../
 // node_modules/@anthropic-ai/claude-code/cli.js`) and reading the sibling
-// package.json — filesystem-only, so it never adds a spawn to the extraction
+// package.json, or the named parent package for the native bin/claude.exe
+// layout — filesystem-only, so it never adds a spawn to the extraction
 // path (verified live: realpath + package.json read, no `claude --version`
 // call). Best-effort: any failure (bare `claude` unresolved via PATH, an
-// install layout that doesn't carry a sibling package.json, a fixture path in
+// install layout that doesn't carry either package.json, a fixture path in
 // tests) yields null, never throws.
 function getClaudeCliVersion(bin, opts = {}) {
   const realpathSyncImpl = typeof opts.realpathSyncImpl === 'function' ? opts.realpathSyncImpl : fs.realpathSync;
   const readFileSyncImpl = typeof opts.readFileSyncImpl === 'function' ? opts.readFileSyncImpl : fs.readFileSync;
   try {
     const real = realpathSyncImpl(bin);
-    const pkgPath = path.join(path.dirname(real), 'package.json');
-    const pkg = JSON.parse(readFileSyncImpl(pkgPath, 'utf8'));
-    return pkg && typeof pkg.version === 'string' ? pkg.version : null;
+    const dir = path.dirname(real);
+    for (const [pkgDir, requireName] of [[dir, false], [path.dirname(dir), true]]) {
+      try {
+        const pkg = JSON.parse(readFileSyncImpl(path.join(pkgDir, 'package.json'), 'utf8'));
+        if (pkg && typeof pkg.version === 'string' && (!requireName || pkg.name === '@anthropic-ai/claude-code')) {
+          return pkg.version;
+        }
+      } catch (_) { /* unreadable sibling may still have a valid parent */ }
+    }
   } catch {
-    return null;
+    /* unresolved binary */
   }
+  return null;
 }
 
 // ─── Env scrub (EXTRACT-TOOLS-LOCK, PUNCH-LIST) ────────────────────────────
@@ -345,6 +386,10 @@ function detectBillingHelperConfigured(opts = {}) {
 function checkAuthStatus(opts = {}) {
   const spawnSyncImpl = typeof opts.spawnSyncImpl === 'function' ? opts.spawnSyncImpl : spawnSync;
   const bin = typeof opts.claudeBin === 'string' ? opts.claudeBin : resolveClaudeBin(opts);
+  const version = versionParts(getClaudeCliVersion(bin, opts));
+  // Older CLIs treat `auth status` as a model prompt. Unknown versions retain
+  // the existing probe; only a known-old build can safely skip it here.
+  if (version && compareVersions(version, [2, 1, 41]) < 0) return 'unknown';
   let res;
   try {
     res = spawnSyncImpl(bin, ['auth', 'status'], {

package/scripts/providers/codex-cli.js

@@ -9,13 +9,18 @@
  * builder's own `codex` login (or their own OPENAI_API_KEY, see detect()
  * below), scrubbed of every var that could redirect billing elsewhere.
  *
- * Flags verified live against `codex exec --help` (codex-cli 0.144.5) before
- * this module was written — see BUILD-SPEC-EXTRACT-PER-CLIENT-W1 §1/§6:
+ * Isolation flags and config keys were source-verified against codex-cli
+ * 0.144.5 — see BUILD-SPEC-CODEX-ROUTE-ISOLATION §2–§3:
  *   -s, --sandbox <read-only|workspace-write|danger-full-access>
  *   --skip-git-repo-check   (codex refuses to run outside a git repo otherwise)
  *   --ephemeral              (no session file left behind)
  *   --ignore-user-config     (don't load ~/.codex/config.toml — auth still
  *                             comes from CODEX_HOME/auth.json regardless)
+ *   --ignore-rules           (don't load project instruction files)
+ *   --strict-config          (reject unknown config keys before model use)
+ *   -C <DIR>                 (run from a fresh private empty directory)
+ *   --json                   (emit the lifecycle stream audited below)
+ *   --disable / -c           (remove optional tools/context injection)
  *   --output-schema <FILE>   (a JSON-Schema HINT, not a hard parser — see
  *                             schemas/*.schema.json for the shapes)
  *   -o, --output-last-message <FILE>  (where the final answer lands)
@@ -33,6 +38,45 @@ const { SCRUBBED_CLIENT_ENV_VARS } = require('./claude-code.js');
 const EXTRACTION_SCHEMA_PATH = path.join(__dirname, 'schemas', 'extraction-envelope.schema.json');
 const JUDGE_SCHEMA_PATH = path.join(__dirname, 'schemas', 'judge-decisions.schema.json');
 
+const ISOLATION_DISABLED_FEATURES = Object.freeze([
+  'shell_tool',
+  'unified_exec',
+  'shell_snapshot',
+  'hooks',
+  'multi_agent',
+  'apps',
+  'plugins',
+  'remote_plugin',
+  'tool_suggest',
+  'image_generation',
+  'goals',
+  'memories',
+  'skill_mcp_dependency_install',
+  'guardian_approval',
+]);
+
+const ISOLATION_CONFIG_OVERRIDES = Object.freeze([
+  'web_search="disabled"',
+  'notify=[]',
+  'tools.experimental_request_user_input.enabled=false',
+  'project_doc_max_bytes=0',
+  'skills.include_instructions=false',
+  'orchestrator.skills.enabled=false',
+  'include_environment_context=false',
+  'include_apps_instructions=false',
+  'include_permissions_instructions=false',
+  'include_collaboration_mode_instructions=false',
+]);
+
+const DEFAULT_SYSTEM_CONFIG_PATHS = Object.freeze([
+  '/etc/codex/config.toml',
+  '/etc/codex/requirements.toml',
+]);
+
+const ALLOWED_ITEM_TYPES = new Set(['agent_message', 'reasoning', 'todo_list', 'error']);
+const AUDITED_ITEM_EVENTS = new Set(['item.started', 'item.updated', 'item.completed']);
+const AUTH_FAILURE_RE = /not authenticated|not logged in|codex login/i;
+
 /** Resolve the `codex` binary — hook/launchd env may have a minimal PATH. */
 function resolveCodexBin(opts = {}) {
   const homeDir = typeof opts.homeDir === 'string' ? opts.homeDir : os.homedir();
@@ -66,9 +110,64 @@ function codexChildEnv() {
   const childEnv = { ...process.env, AUXILO_EXTRACTING: '1' };
   for (const key of SCRUBBED_CLIENT_ENV_VARS) delete childEnv[key];
   delete childEnv.OPENAI_API_KEY;
+  for (const key of Object.keys(childEnv)) {
+    if (key.startsWith('CODEX_EXEC_SERVER_')) delete childEnv[key];
+  }
+  childEnv.CODEX_EXEC_SERVER_URL = 'none';
   return childEnv;
 }
 
+function neutralizeSkillMentions(text) {
+  return String(text).replace(/\$(?=[A-Za-z0-9_:-])/g, '$\u200B');
+}
+
+function stripNeutralizationMarker(text) {
+  return String(text).replace(/\u200B/g, '');
+}
+
+function parseJsonlEvents(stdout) {
+  const events = [];
+  for (const line of String(stdout || '').split(/\r?\n/)) {
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed && typeof parsed === 'object' && typeof parsed.type === 'string') {
+        events.push(parsed);
+      }
+    } catch { /* non-JSON stdout lines are ignored */ }
+  }
+  return events;
+}
+
+function eventAuthMessages(events) {
+  const messages = [];
+  for (const event of events) {
+    if (event.type === 'error' || event.type === 'turn.failed') {
+      if (typeof event.message === 'string') messages.push(event.message);
+      if (event.error && typeof event.error.message === 'string') messages.push(event.error.message);
+    }
+    if (AUDITED_ITEM_EVENTS.has(event.type)
+      && event.item
+      && event.item.type === 'error'
+      && typeof event.item.message === 'string') {
+      messages.push(event.item.message);
+    }
+  }
+  return messages;
+}
+
+function lastCompletedAgentMessage(events) {
+  let text = '';
+  for (const event of events) {
+    if (event.type === 'item.completed'
+      && event.item
+      && event.item.type === 'agent_message'
+      && typeof event.item.text === 'string') {
+      text = event.item.text;
+    }
+  }
+  return text;
+}
+
 /**
  * Read ~/.codex/auth.json and return its `auth_mode` string, or null when the
  * file is missing, unreadable, malformed, or auth_mode is absent/falsy. Never
@@ -114,10 +213,9 @@ function detect(opts = {}) {
 
 // ─── codex --version capture (extraction_model.version) ───────────────────
 //
-// codex exposes no per-call model identifier (no --json event stream is
-// requested here, and -o's last-message file carries prose/schema-shaped
-// output only) — the CLI build version is the honest proxy for "which codex
-// build ran this extraction". Captured once per process and cached: every
+// This route preserves its existing null per-call model identifier; the CLI
+// build version is the honest proxy for "which codex build ran this
+// extraction". Captured once per process and cached: every
 // runModel() call after the first reuses the cached value, so a session that
 // calls runModel() twice (extract, then judge) only pays for one version
 // probe. `undefined` = not yet probed; `null` = probed, could not determine.
@@ -175,17 +273,14 @@ function classifySpawnError(error, bin) {
 }
 
 /**
- * Shared invocation for both modes: builds argv, spawns, reads the answer
- * back from the `-o` file (falling back to stdout only if that file cannot
- * be read — see module comment on why: --output-last-message's own docs
- * promise a file is written on a normal completion, but say nothing about a
- * crash/timeout/schema-rejection path, so a defensive stdout fallback covers
- * the cases where no file ever landed; text as documented is the file's
- * content and stdout is treated as the exception path, never the default).
+ * Shared invocation for both modes: builds the isolated argv, spawns, audits
+ * the JSONL lifecycle stream, and reads the answer back from the `-o` file.
+ * If that file cannot be read, only the last completed agent-message event is
+ * eligible as a fallback; raw stdout is never returned.
  *
  * The `-o` file's private-dir creation, 0600 chmod, and cleanup (GOV-3
  * should-fix item 11) are handled by an outer try/finally so EVERY exit
- * path — auth-not-configured, every spawn-error/timeout classification,
+ * path after directory creation — every spawn-error/timeout classification,
  * non-zero exit, empty output, and the normal success path — cleans up the
  * same way. `cleanupDir` is null (nothing to remove) when the caller
  * supplied its own `opts.outputPath`.
@@ -196,6 +291,9 @@ function invoke(opts, mode) {
   const unlinkSyncImpl = typeof opts.unlinkSyncImpl === 'function' ? opts.unlinkSyncImpl : fs.unlinkSync;
   const rmdirSyncImpl = typeof opts.rmdirSyncImpl === 'function' ? opts.rmdirSyncImpl : fs.rmdirSync;
   const chmodSyncImpl = typeof opts.chmodSyncImpl === 'function' ? opts.chmodSyncImpl : fs.chmodSync;
+  const mkdtempSyncImpl = typeof opts.mkdtempSyncImpl === 'function' ? opts.mkdtempSyncImpl : fs.mkdtempSync;
+  const rmSyncImpl = typeof opts.rmSyncImpl === 'function' ? opts.rmSyncImpl : fs.rmSync;
+  const existsSync = typeof opts.existsSync === 'function' ? opts.existsSync : fs.existsSync;
   const bin = typeof opts.codexBin === 'string' ? opts.codexBin : resolveCodexBin(opts);
 
   const authMode = readAuthMode(opts);
@@ -210,17 +308,43 @@ function invoke(opts, mode) {
     };
   }
 
+  const systemConfigPaths = Array.isArray(opts.systemConfigPaths)
+    ? opts.systemConfigPaths
+    : DEFAULT_SYSTEM_CONFIG_PATHS;
+  for (const systemConfigPath of systemConfigPaths) {
+    let exists = false;
+    try { exists = existsSync(systemConfigPath); } catch { /* unreadable is treated as absent */ }
+    if (exists) {
+      return {
+        ok: false,
+        text: '',
+        usage: null,
+        reason: `codex system configuration is present at ${systemConfigPath}`,
+        reasonCode: 'isolation-precondition',
+        authStatus: 'unknown',
+      };
+    }
+  }
+
   const { outputPath, cleanupDir } = makeOutputLocation(opts, mode);
+  let workDir = null;
   try {
+    workDir = mkdtempSyncImpl(path.join(os.tmpdir(), 'auxilo-codex-cwd-'));
     const schemaFile = mode === 'judge' ? JUDGE_SCHEMA_PATH : EXTRACTION_SCHEMA_PATH;
     const prompt = typeof opts.prompt === 'string' ? opts.prompt : '';
-    const stdin = prompt + String(opts.input || '');
+    const stdin = neutralizeSkillMentions(prompt + String(opts.input || ''));
     const args = [
       'exec',
       '-s', 'read-only',
       '--skip-git-repo-check',
       '--ephemeral',
       '--ignore-user-config',
+      '--ignore-rules',
+      '--strict-config',
+      '-C', workDir,
+      '--json',
+      ...ISOLATION_DISABLED_FEATURES.flatMap((feature) => ['--disable', feature]),
+      ...ISOLATION_CONFIG_OVERRIDES.flatMap((override) => ['-c', override]),
       '--output-schema', schemaFile,
       '-o', outputPath,
       '-',
@@ -232,6 +356,7 @@ function invoke(opts, mode) {
         input: stdin,
         encoding: 'utf-8',
         env: codexChildEnv(),
+        cwd: workDir,
         timeout: opts.timeoutMs || 120000,
         maxBuffer: 20 * 1024 * 1024,
       });
@@ -253,7 +378,9 @@ function invoke(opts, mode) {
     }
 
     const stdout = String(res.stdout || '');
-    if (/not authenticated|not logged in|codex login/i.test(stdout) || /not authenticated|not logged in|codex login/i.test(String(res.stderr || ''))) {
+    const stderr = String(res.stderr || '');
+    const events = parseJsonlEvents(stdout);
+    if (AUTH_FAILURE_RE.test(stderr) || eventAuthMessages(events).some((message) => AUTH_FAILURE_RE.test(message))) {
       return { ok: false, text: '', usage: null, reason: 'codex CLI reported it is not authenticated', reasonCode: 'cli-unauthenticated', authStatus: 'unknown' };
     }
     if (res.status !== 0) {
@@ -261,12 +388,40 @@ function invoke(opts, mode) {
         ok: false,
         text: '',
         usage: null,
-        reason: `codex exec exited ${res.status}: ${(stdout || String(res.stderr || '')).slice(0, 160)}`,
+        reason: `codex exec exited ${res.status}: ${stderr.slice(0, 160)}`,
         reasonCode: 'model-error',
         authStatus: 'unknown',
       };
     }
 
+    if (events.length === 0) {
+      return {
+        ok: false,
+        text: '',
+        usage: null,
+        reason: 'codex exec emitted no parseable lifecycle event',
+        reasonCode: 'isolation-unverified',
+        authStatus: 'unknown',
+      };
+    }
+
+    for (const event of events) {
+      if (!AUDITED_ITEM_EVENTS.has(event.type)) continue;
+      const itemType = event.item && typeof event.item.type === 'string'
+        ? event.item.type
+        : 'unknown';
+      if (!ALLOWED_ITEM_TYPES.has(itemType)) {
+        return {
+          ok: false,
+          text: '',
+          usage: null,
+          reason: `codex exec emitted disallowed item type: ${itemType}`,
+          reasonCode: 'isolation-violation',
+          authStatus: 'unknown',
+        };
+      }
+    }
+
     // Force 0600 before reading — codex writes this file itself, under its
     // own umask, which may not match. Best-effort: a file that doesn't
     // exist (never written) or can't be chmod'd fails silently here and the
@@ -278,20 +433,19 @@ function invoke(opts, mode) {
     try {
       text = String(readFileSyncImpl(outputPath, 'utf8'));
     } catch {
-      // --output-last-message's own docs make no promise about a file existing
-      // outside a normal completion — fall back to stdout rather than
-      // reporting a false failure when codex exited 0 but the file is absent.
-      text = stdout;
+      text = lastCompletedAgentMessage(events);
       usedStdoutFallback = true;
     }
 
+    text = stripNeutralizationMarker(text);
+
     if (!text.trim()) {
       return {
         ok: false,
         text: '',
         usage: null,
         reason: usedStdoutFallback
-          ? 'codex exec produced no output-last-message file and stdout was empty'
+          ? 'codex exec produced no output-last-message file and no completed agent message'
           : 'codex exec produced an empty output-last-message file',
         reasonCode: 'cli-bad-output',
         authStatus: 'unknown',
@@ -310,7 +464,7 @@ function invoke(opts, mode) {
     // until that test (and any external consumer) moves to `.identity`.
     const identity = {
       provider: 'codex-cli',
-      model: null, // codex exposes no per-call model id without --json (not requested)
+      model: null, // the route intentionally preserves its existing identity contract
       version: getCodexVersion(opts),
       vendor: null,
     };
@@ -333,6 +487,9 @@ function invoke(opts, mode) {
     if (cleanupDir) {
       try { rmdirSyncImpl(cleanupDir); } catch { /* best-effort cleanup only */ }
     }
+    if (workDir) {
+      try { rmSyncImpl(workDir, { recursive: true, force: true }); } catch { /* best-effort cleanup only */ }
+    }
   }
 }
 
@@ -349,6 +506,10 @@ module.exports = {
   readAuthMode,
   codexChildEnv,
   getCodexVersion,
+  neutralizeSkillMentions,
+  stripNeutralizationMarker,
+  ISOLATION_DISABLED_FEATURES,
+  ISOLATION_CONFIG_OVERRIDES,
   EXTRACTION_SCHEMA_PATH,
   JUDGE_SCHEMA_PATH,
   _resetVersionCacheForTests,

package/scripts/providers/provider.interface.js

@@ -61,6 +61,7 @@
  *   are not required to estimate on the caller's behalf.
  * @property {string} [reasonCode] - Machine-matchable failure/skip classifier
  *   (e.g. 'cli-unauthenticated', 'cli-billing-helper-configured', 'model-error',
+ *   'isolation-precondition', 'isolation-unverified', 'isolation-violation',
  *   'unknown'). Present on both success and failure paths where applicable.
  * @property {string|null} [reason] - Human-readable reason, present when !ok.
  * @property {string} [authStatus] - 'logged-in' | 'logged-out' | 'unknown', when