customer-map-codex-bridge 0.5.1 → 0.5.2

package/README.md

@@ -1,52 +1,52 @@
-# Customer Map Codex Bridge
-
-This local helper connects a user's already-authenticated Codex installation to Customer Map without sending Codex credentials or API keys to Customer Map.
-
-## Requirements
-
-- Codex CLI installed and already signed in locally (`codex login`).
-- Optional Gmail actions require `gog` v0.11.0+ with the intended Gmail account already authorized locally.
-- Node.js 18+.
-- The Customer Map Agent settings panel must provide a one-time `CMAP-CODEX-*` code.
-
-The settings panel reports **Connected** only after both the local Codex app-server and the Customer Map relay WebSocket are online. A claimed code by itself is only a pending binding.
-
-## Run
-
-```bash
-npx -y customer-map-codex-bridge@0.5.1 \
-  --site https://your-customer-map.example \
-  --code CMAP-CODEX-XXXXXXXXXXXX
-```
-
-Starting a newly authorized Bridge automatically replaces the older Bridge for the same Customer Map account. Clicking **Remove connection** in Customer Map disconnects the running Bridge, so users do not need to find or kill local processes.
-
-The Bridge automatically reconnects to the Relay after temporary network or Relay interruptions, using exponential backoff from 1 second up to 30 seconds. It keeps the local Codex process and bridge token in memory during retries. A removed connection, an expired token, or a Bridge replaced by a newer Bridge exits instead of retrying.
-
-The bridge initializes Codex App Server with native live web search enabled, then explicitly applies a read-only sandbox with no approval prompts and command network access disabled to every new thread and every turn. This lets the assistants search and read public pages without granting model-generated shell commands arbitrary network or file-write access. Credentials stay on the local machine, and thread IDs are stored under `~/.customer-map-codex/state.json` and resumed after Bridge restarts. Task Assistant, Workbench Assistant, and Sales Assistant use separate thread scopes.
-
-When the user explicitly chooses **Save Gmail draft** or **Send email** in Customer Map, the bridge bypasses the Codex turn and executes only a validated, fixed `gog gmail drafts create` or `gog gmail send` argument list. It verifies the content hash and requires a real Gmail message/draft ID before reporting success. Chat cannot turn this into an arbitrary shell or network action.
-
-If the protocol handler cannot find `codex`, pass its absolute path explicitly:
-
-```bash
-npx -y customer-map-codex-bridge@0.5.1 \
-  --site https://your-customer-map.example \
-  --code CMAP-CODEX-XXXXXXXXXXXX \
-  --codex /absolute/path/to/codex
-```
-
-If `gog` is outside the standard Homebrew/system paths, pass it explicitly:
-
-```bash
-npx -y customer-map-codex-bridge@0.5.1 \
-  --site https://your-customer-map.example \
-  --code CMAP-CODEX-XXXXXXXXXXXX \
-  --gog /absolute/path/to/gog
-```
-
-The website can then open:
-
-```text
-customer-map-codex://connect?site=https%3A%2F%2Fyour-customer-map.example&code=CMAP-CODEX-XXXXXXXXXXXX
-```
+# Customer Map Codex Bridge
+
+This local helper connects a user's already-authenticated Codex installation to Customer Map without sending Codex credentials or API keys to Customer Map.
+
+## Requirements
+
+- Codex CLI installed and already signed in locally (`codex login`).
+- Optional Gmail actions require `gog` v0.11.0+ with the intended Gmail account already authorized locally.
+- Node.js 18+.
+- The Customer Map Agent settings panel must provide a one-time `CMAP-CODEX-*` code.
+
+The settings panel reports **Connected** only after both the local Codex app-server and the Customer Map relay WebSocket are online. A claimed code by itself is only a pending binding.
+
+## Run
+
+```bash
+npx -y customer-map-codex-bridge@0.5.2 \
+  --site https://your-customer-map.example \
+  --code CMAP-CODEX-XXXXXXXXXXXX
+```
+
+Starting a newly authorized Bridge automatically replaces the older Bridge for the same Customer Map account. Clicking **Remove connection** in Customer Map disconnects the running Bridge, so users do not need to find or kill local processes.
+
+The Bridge automatically reconnects to the Relay after temporary network or Relay interruptions, using exponential backoff from 1 second up to 30 seconds. It keeps the local Codex process and bridge token in memory during retries. A removed connection, an expired token, or a Bridge replaced by a newer Bridge exits instead of retrying.
+
+The bridge initializes Codex App Server with native live web search enabled, then explicitly applies a read-only sandbox with no approval prompts and command network access disabled to every new thread and every turn. This lets the assistants search and read public pages without granting model-generated shell commands arbitrary network or file-write access. Credentials stay on the local machine, and thread IDs are stored under `~/.customer-map-codex/state.json` and resumed after Bridge restarts. Task Assistant, Workbench Assistant, and Sales Assistant use separate thread scopes.
+
+When the user explicitly chooses **Save Gmail draft** or **Send email** in Customer Map, the bridge bypasses the Codex turn and executes only a validated, fixed `gog gmail drafts create` or `gog gmail send` argument list. It verifies the content hash and requires a real Gmail message/draft ID before reporting success. Chat cannot turn this into an arbitrary shell or network action.
+
+If the protocol handler cannot find `codex`, pass its absolute path explicitly:
+
+```bash
+npx -y customer-map-codex-bridge@0.5.2 \
+  --site https://your-customer-map.example \
+  --code CMAP-CODEX-XXXXXXXXXXXX \
+  --codex /absolute/path/to/codex
+```
+
+If `gog` is outside the standard Homebrew/system paths, pass it explicitly:
+
+```bash
+npx -y customer-map-codex-bridge@0.5.2 \
+  --site https://your-customer-map.example \
+  --code CMAP-CODEX-XXXXXXXXXXXX \
+  --gog /absolute/path/to/gog
+```
+
+The website can then open:
+
+```text
+customer-map-codex://connect?site=https%3A%2F%2Fyour-customer-map.example&code=CMAP-CODEX-XXXXXXXXXXXX
+```

package/codex-process.mjs

@@ -0,0 +1,43 @@
+import { spawn } from 'node:child_process';
+import { delimiter, dirname } from 'node:path';
+import process from 'node:process';
+
+export const CODEX_APP_SERVER_ARGS = [
+  'app-server',
+  '--listen',
+  'stdio://',
+  '-c',
+  'web_search="live"',
+];
+
+export function startCodexAppServer(cwd, command) {
+  const pathValue = [dirname(process.execPath), dirname(command), process.env.PATH || '']
+    .filter(Boolean)
+    .join(delimiter);
+  const options = {
+    cwd,
+    stdio: ['pipe', 'pipe', 'inherit'],
+    windowsHide: true,
+    env: { ...process.env, PATH: pathValue },
+  };
+
+  if (process.platform !== 'win32') return spawn(command, CODEX_APP_SERVER_ARGS, options);
+
+  const commandShell = process.env.ComSpec || process.env.COMSPEC || 'C:\\Windows\\System32\\cmd.exe';
+  // cmd.exe needs one outer pair of quotes around the complete /c command.
+  // windowsVerbatimArguments keeps Node from escaping those quotes.
+  const commandLine = buildWindowsCodexCommandLine(command, CODEX_APP_SERVER_ARGS);
+  return spawn(commandShell, ['/d', '/s', '/c', commandLine], {
+    ...options,
+    windowsVerbatimArguments: true,
+  });
+}
+
+export function buildWindowsCodexCommandLine(command, args = CODEX_APP_SERVER_ARGS) {
+  return '"' + [command, ...args].map(quoteWindowsArg).join(' ') + '"';
+}
+
+function quoteWindowsArg(value) {
+  // Within a cmd.exe command, embedded quotes are escaped by doubling them.
+  return '"' + String(value).replaceAll('"', '""') + '"';
+}