customer-map-codex-bridge 0.5.1 → 0.5.3

package/README.md

@@ -1,52 +1,64 @@
-# Customer Map Codex Bridge
-
-This local helper connects a user's already-authenticated Codex installation to Customer Map without sending Codex credentials or API keys to Customer Map.
-
-## Requirements
-
-- Codex CLI installed and already signed in locally (`codex login`).
-- Optional Gmail actions require `gog` v0.11.0+ with the intended Gmail account already authorized locally.
-- Node.js 18+.
-- The Customer Map Agent settings panel must provide a one-time `CMAP-CODEX-*` code.
-
-The settings panel reports **Connected** only after both the local Codex app-server and the Customer Map relay WebSocket are online. A claimed code by itself is only a pending binding.
-
-## Run
-
+# Customer Map Codex Bridge
+
+This local helper connects a user's already-authenticated Codex installation to Customer Map without sending Codex credentials or API keys to Customer Map.
+
+## Requirements
+
+- Codex CLI installed and already signed in locally (`codex login`).
+- Optional Gmail actions require `gog` v0.11.0+ with the intended Gmail account already authorized locally.
+- Node.js 18+.
+- The Customer Map Agent settings panel must provide a one-time `CMAP-CODEX-*` code.
+
+The settings panel reports **Connected** only after both the local Codex app-server and the Customer Map relay WebSocket are online. A claimed code by itself is only a pending binding.
+
+## Run
+
 ```bash
-npx -y customer-map-codex-bridge@0.5.1 \
+npx -y customer-map-codex-bridge@0.5.3 \
   --site https://your-customer-map.example \
   --code CMAP-CODEX-XXXXXXXXXXXX
 ```
 
-Starting a newly authorized Bridge automatically replaces the older Bridge for the same Customer Map account. Clicking **Remove connection** in Customer Map disconnects the running Bridge, so users do not need to find or kill local processes.
-
-The Bridge automatically reconnects to the Relay after temporary network or Relay interruptions, using exponential backoff from 1 second up to 30 seconds. It keeps the local Codex process and bridge token in memory during retries. A removed connection, an expired token, or a Bridge replaced by a newer Bridge exits instead of retrying.
-
-The bridge initializes Codex App Server with native live web search enabled, then explicitly applies a read-only sandbox with no approval prompts and command network access disabled to every new thread and every turn. This lets the assistants search and read public pages without granting model-generated shell commands arbitrary network or file-write access. Credentials stay on the local machine, and thread IDs are stored under `~/.customer-map-codex/state.json` and resumed after Bridge restarts. Task Assistant, Workbench Assistant, and Sales Assistant use separate thread scopes.
+## Click-to-authorize (Windows and macOS)
 
-When the user explicitly chooses **Save Gmail draft** or **Send email** in Customer Map, the bridge bypasses the Codex turn and executes only a validated, fixed `gog gmail drafts create` or `gog gmail send` argument list. It verifies the content hash and requires a real Gmail message/draft ID before reporting success. Chat cannot turn this into an arbitrary shell or network action.
-
-If the protocol handler cannot find `codex`, pass its absolute path explicitly:
+The Customer Map button can open the local authorization window directly after the protocol handler is registered once. Run this one-time command in a terminal on the computer where Codex is installed:
 
 ```bash
-npx -y customer-map-codex-bridge@0.5.1 \
-  --site https://your-customer-map.example \
-  --code CMAP-CODEX-XXXXXXXXXXXX \
-  --codex /absolute/path/to/codex
+npx -y customer-map-codex-bridge@0.5.3 --install-protocol
 ```
 
-If `gog` is outside the standard Homebrew/system paths, pass it explicitly:
-
+The installer registers the `customer-map-codex://` URL scheme for the current user and stores the local Codex path. It does not upload credentials or start a Bridge. Return to Customer Map and click **Open Codex authorization**; the native authorization window will appear on Windows or macOS.
+
+If the browser still does not open the window, use the **fallback command** shown in Agent settings. This is also the supported path on Linux, where click-to-authorize is not currently registered.
+
+Starting a newly authorized Bridge automatically replaces the older Bridge for the same Customer Map account. Clicking **Remove connection** in Customer Map disconnects the running Bridge, so users do not need to find or kill local processes.
+
+The Bridge automatically reconnects to the Relay after temporary network or Relay interruptions, using exponential backoff from 1 second up to 30 seconds. It keeps the local Codex process and bridge token in memory during retries. A removed connection, an expired token, or a Bridge replaced by a newer Bridge exits instead of retrying.
+
+The bridge initializes Codex App Server with native live web search enabled, then explicitly applies a read-only sandbox with no approval prompts and command network access disabled to every new thread and every turn. This lets the assistants search and read public pages without granting model-generated shell commands arbitrary network or file-write access. Credentials stay on the local machine, and thread IDs are stored under `~/.customer-map-codex/state.json` and resumed after Bridge restarts. Task Assistant, Workbench Assistant, and Sales Assistant use separate thread scopes.
+
+When the user explicitly chooses **Save Gmail draft** or **Send email** in Customer Map, the bridge bypasses the Codex turn and executes only a validated, fixed `gog gmail drafts create` or `gog gmail send` argument list. It verifies the content hash and requires a real Gmail message/draft ID before reporting success. Chat cannot turn this into an arbitrary shell or network action.
+
+If the protocol handler cannot find `codex`, pass its absolute path explicitly:
+
 ```bash
-npx -y customer-map-codex-bridge@0.5.1 \
-  --site https://your-customer-map.example \
-  --code CMAP-CODEX-XXXXXXXXXXXX \
-  --gog /absolute/path/to/gog
-```
-
-The website can then open:
-
-```text
-customer-map-codex://connect?site=https%3A%2F%2Fyour-customer-map.example&code=CMAP-CODEX-XXXXXXXXXXXX
+npx -y customer-map-codex-bridge@0.5.3 \
+  --site https://your-customer-map.example \
+  --code CMAP-CODEX-XXXXXXXXXXXX \
+  --codex /absolute/path/to/codex
 ```
+
+If `gog` is outside the standard Homebrew/system paths, pass it explicitly:
+
+```bash
+npx -y customer-map-codex-bridge@0.5.3 \
+  --site https://your-customer-map.example \
+  --code CMAP-CODEX-XXXXXXXXXXXX \
+  --gog /absolute/path/to/gog
+```
+
+The website can then open:
+
+```text
+customer-map-codex://connect?site=https%3A%2F%2Fyour-customer-map.example&code=CMAP-CODEX-XXXXXXXXXXXX
+```

package/authorization-macos.applescript

@@ -0,0 +1,35 @@
+use framework "Cocoa"
+use scripting additions
+
+on run argv
+  if (count of argv) is less than 1 then return "ERROR"
+
+  set siteUrl to item 1 of argv
+  set alert to current application's NSAlert's alloc()'s init()
+  alert's setMessageText:"Connect Customer Map to Codex"
+  alert's setInformativeText:("Use the Codex already signed in on this Mac." & return & return & ¬
+    "Read-only Codex conversations and public-web search are available for your sales tasks." & return & ¬
+    "File writes and model-generated command networking remain blocked." & return & ¬
+    "Only explicit Gmail draft or send actions may use your local gog installation.")
+  alert's setAlertStyle:(current application's NSInformationalAlertStyle)
+
+  set siteField to current application's NSTextField's alloc()'s initWithFrame:{{0, 0}, {360, 28}}
+  siteField's setStringValue:siteUrl
+  siteField's setEditable:false
+  siteField's setSelectable:true
+  siteField's setBezeled:true
+  siteField's setDrawsBackground:true
+  siteField's setBackgroundColor:(current application's NSColor's colorWithCalibratedWhite:0.96 alpha:1.0)
+  siteField's setTextColor:(current application's NSColor's colorWithCalibratedWhite:0.22 alpha:1.0)
+  siteField's setFont:(current application's NSFont's monospacedSystemFontOfSize:11 weight:(current application's NSFontWeightRegular))
+  siteField's setLineBreakMode:(current application's NSLineBreakByTruncatingMiddle)
+  alert's setAccessoryView:siteField
+
+  alert's addButtonWithTitle:"Cancel"
+  alert's addButtonWithTitle:"Allow connection"
+
+  current application's NSApp's activateIgnoringOtherApps:true
+  set response to alert's runModal()
+  if response is (current application's NSAlertSecondButtonReturn) then return "ALLOW"
+  return "CANCEL"
+end run

package/authorization-windows.ps1

@@ -0,0 +1,300 @@
+param(
+  [Parameter(Mandatory = $true)]
+  [string]$Site,
+  [switch]$TestMode,
+  [string]$RenderPath = ''
+)
+
+$ErrorActionPreference = 'Stop'
+
+try {
+  Add-Type -AssemblyName PresentationFramework
+  Add-Type -AssemblyName PresentationCore
+  Add-Type -AssemblyName WindowsBase
+
+  [xml]$xaml = @'
+<Window
+  xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+  xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+  Title="Customer Map - Codex authorization"
+  Width="560"
+  Height="540"
+  WindowStartupLocation="CenterScreen"
+  ResizeMode="NoResize"
+  ShowActivated="True"
+  Topmost="True"
+  Background="#F6F5F2"
+  FontFamily="Segoe UI"
+  UseLayoutRounding="True"
+  SnapsToDevicePixels="True">
+  <Window.Resources>
+    <Style x:Key="QuietButton" TargetType="Button">
+      <Setter Property="MinWidth" Value="104"/>
+      <Setter Property="Height" Value="38"/>
+      <Setter Property="Padding" Value="18,0"/>
+      <Setter Property="FontSize" Value="13"/>
+      <Setter Property="FontWeight" Value="SemiBold"/>
+      <Setter Property="Cursor" Value="Hand"/>
+      <Setter Property="Template">
+        <Setter.Value>
+          <ControlTemplate TargetType="Button">
+            <Border
+              x:Name="ButtonSurface"
+              Background="{TemplateBinding Background}"
+              BorderBrush="{TemplateBinding BorderBrush}"
+              BorderThickness="1"
+              CornerRadius="6"
+              RenderTransformOrigin="0.5,0.5">
+              <Border.RenderTransform>
+                <ScaleTransform ScaleX="1" ScaleY="1"/>
+              </Border.RenderTransform>
+              <ContentPresenter
+                HorizontalAlignment="Center"
+                VerticalAlignment="Center"
+                RecognizesAccessKey="True"/>
+            </Border>
+            <ControlTemplate.Triggers>
+              <Trigger Property="IsMouseOver" Value="True">
+                <Setter TargetName="ButtonSurface" Property="Opacity" Value="0.9"/>
+              </Trigger>
+              <Trigger Property="IsPressed" Value="True">
+                <Setter TargetName="ButtonSurface" Property="Opacity" Value="0.82"/>
+                <Setter TargetName="ButtonSurface" Property="RenderTransform">
+                  <Setter.Value>
+                    <ScaleTransform ScaleX="0.98" ScaleY="0.98"/>
+                  </Setter.Value>
+                </Setter>
+              </Trigger>
+              <Trigger Property="IsKeyboardFocused" Value="True">
+                <Setter TargetName="ButtonSurface" Property="BorderBrush" Value="#315F7D"/>
+                <Setter TargetName="ButtonSurface" Property="BorderThickness" Value="2"/>
+              </Trigger>
+              <Trigger Property="IsEnabled" Value="False">
+                <Setter TargetName="ButtonSurface" Property="Opacity" Value="0.45"/>
+              </Trigger>
+            </ControlTemplate.Triggers>
+          </ControlTemplate>
+        </Setter.Value>
+      </Setter>
+    </Style>
+    <Style x:Key="PrimaryButton" TargetType="Button" BasedOn="{StaticResource QuietButton}">
+      <Setter Property="MinWidth" Value="124"/>
+      <Setter Property="Background" Value="#1F2328"/>
+      <Setter Property="BorderBrush" Value="#1F2328"/>
+      <Setter Property="Foreground" Value="#FFFFFF"/>
+    </Style>
+    <Style x:Key="SecondaryButton" TargetType="Button" BasedOn="{StaticResource QuietButton}">
+      <Setter Property="Background" Value="#FFFFFF"/>
+      <Setter Property="BorderBrush" Value="#B7C8D1"/>
+      <Setter Property="Foreground" Value="#1F2328"/>
+    </Style>
+  </Window.Resources>
+
+  <Grid Margin="12">
+    <Border
+      Background="#FFFFFF"
+      BorderBrush="#E2E8F0"
+      BorderThickness="1"
+      CornerRadius="8">
+      <Grid>
+        <Grid.RowDefinitions>
+          <RowDefinition Height="3"/>
+          <RowDefinition Height="Auto"/>
+          <RowDefinition Height="*"/>
+          <RowDefinition Height="68"/>
+        </Grid.RowDefinitions>
+
+        <Border Grid.Row="0" Background="#315F7D" CornerRadius="8,8,0,0"/>
+
+        <Grid Grid.Row="1" Margin="22,18,22,14">
+          <Grid.ColumnDefinitions>
+            <ColumnDefinition Width="42"/>
+            <ColumnDefinition Width="*"/>
+          </Grid.ColumnDefinitions>
+          <Border
+            Width="38"
+            Height="38"
+            HorizontalAlignment="Left"
+            VerticalAlignment="Top"
+            Background="#DBE8F0"
+            CornerRadius="6">
+            <TextBlock
+              Text="CM"
+              HorizontalAlignment="Center"
+              VerticalAlignment="Center"
+              Foreground="#1F2328"
+              FontSize="12"
+              FontWeight="Bold"/>
+          </Border>
+          <StackPanel Grid.Column="1" Margin="12,0,0,0">
+            <TextBlock
+              Text="Connect Customer Map to Codex"
+              Foreground="#1F2328"
+              FontSize="16"
+              FontWeight="SemiBold"/>
+            <TextBlock
+              Margin="0,4,0,0"
+              Text="Use the Codex already signed in on this computer."
+              Foreground="#667085"
+              FontSize="12.5"/>
+          </StackPanel>
+        </Grid>
+
+        <StackPanel Grid.Row="2" Margin="22,0,22,18">
+          <TextBlock
+            Text="REQUESTING WEBSITE"
+            Foreground="#667085"
+            FontSize="10.5"
+            FontWeight="SemiBold"/>
+          <Border
+            Margin="0,7,0,16"
+            Padding="12,10"
+            Background="#FBFAF8"
+            BorderBrush="#E2E8F0"
+            BorderThickness="1"
+            CornerRadius="6">
+            <TextBlock
+              x:Name="SiteText"
+              Foreground="#1F2328"
+              FontFamily="Consolas"
+              FontSize="12"
+              TextTrimming="CharacterEllipsis"/>
+          </Border>
+
+          <TextBlock
+            Text="WHAT THIS ALLOWS"
+            Foreground="#667085"
+            FontSize="10.5"
+            FontWeight="SemiBold"/>
+
+          <Grid Margin="0,9,0,0">
+            <Grid.ColumnDefinitions>
+      <ColumnDefinition Width="18"/>
+              <ColumnDefinition Width="*"/>
+            </Grid.ColumnDefinitions>
+            <Ellipse Width="7" Height="7" Fill="#315F7D" VerticalAlignment="Top" Margin="2,5,0,0"/>
+            <StackPanel Grid.Column="1">
+              <TextBlock Text="Read-only Codex conversations" Foreground="#1F2328" FontSize="12.5" FontWeight="SemiBold"/>
+              <TextBlock Text="File writes and model-generated command networking stay blocked." Foreground="#667085" FontSize="11.5" Margin="0,2,0,0"/>
+            </StackPanel>
+          </Grid>
+
+          <Grid Margin="0,11,0,0">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="18"/>
+              <ColumnDefinition Width="*"/>
+            </Grid.ColumnDefinitions>
+            <Ellipse Width="7" Height="7" Fill="#315F7D" VerticalAlignment="Top" Margin="2,5,0,0"/>
+            <StackPanel Grid.Column="1">
+              <TextBlock Text="Live public-web search" Foreground="#1F2328" FontSize="12.5" FontWeight="SemiBold"/>
+              <TextBlock Text="Codex may search and read public websites for your sales tasks." Foreground="#667085" FontSize="11.5" Margin="0,2,0,0"/>
+            </StackPanel>
+          </Grid>
+
+          <Grid Margin="0,11,0,0">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="18"/>
+              <ColumnDefinition Width="*"/>
+            </Grid.ColumnDefinitions>
+            <Ellipse Width="7" Height="7" Fill="#315F7D" VerticalAlignment="Top" Margin="2,5,0,0"/>
+            <StackPanel Grid.Column="1">
+              <TextBlock Text="Local credentials stay local" Foreground="#1F2328" FontSize="12.5" FontWeight="SemiBold"/>
+              <TextBlock Text="Customer Map never receives your Codex login or API keys." Foreground="#667085" FontSize="11.5" Margin="0,2,0,0"/>
+            </StackPanel>
+          </Grid>
+
+          <Border
+            Margin="0,16,0,0"
+            Padding="11,9"
+            Background="#E4EBE2"
+            CornerRadius="6">
+            <TextBlock
+              Text="Only explicit Gmail draft or send actions may use your local gog installation."
+              Foreground="#33413A"
+              FontSize="11.5"
+              TextWrapping="Wrap"/>
+          </Border>
+        </StackPanel>
+
+        <Border
+          Grid.Row="3"
+          Background="#FBFAF8"
+          BorderBrush="#E2E8F0"
+          BorderThickness="0,1,0,0"
+          CornerRadius="0,0,8,8">
+          <Grid Margin="22,14">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="*"/>
+              <ColumnDefinition Width="Auto"/>
+              <ColumnDefinition Width="10"/>
+              <ColumnDefinition Width="Auto"/>
+            </Grid.ColumnDefinitions>
+            <TextBlock
+              VerticalAlignment="Center"
+              Text="Manage this connection in Customer Map settings."
+              TextTrimming="CharacterEllipsis"
+              Foreground="#667085"
+              FontSize="10.5"/>
+            <Button
+              x:Name="CancelButton"
+              Grid.Column="1"
+              Content="Cancel"
+              IsCancel="True"
+              Style="{StaticResource SecondaryButton}"/>
+            <Button
+              x:Name="AllowButton"
+              Grid.Column="3"
+              Content="Allow connection"
+              IsDefault="True"
+              Style="{StaticResource PrimaryButton}"/>
+          </Grid>
+        </Border>
+      </Grid>
+    </Border>
+  </Grid>
+</Window>
+'@
+
+  $reader = New-Object System.Xml.XmlNodeReader $xaml
+  $window = [Windows.Markup.XamlReader]::Load($reader)
+  $window.FindName('SiteText').Text = $Site
+
+  if ($TestMode) {
+    if ($RenderPath) {
+      $window.WindowStartupLocation = 'Manual'
+      $window.Left = -10000
+      $window.Top = -10000
+      $window.ShowInTaskbar = $false
+      $window.Show()
+      $window.UpdateLayout()
+
+      $width = [Math]::Max(1, [int][Math]::Ceiling($window.ActualWidth))
+      $height = [Math]::Max(1, [int][Math]::Ceiling($window.ActualHeight))
+      $bitmap = New-Object Windows.Media.Imaging.RenderTargetBitmap($width, $height, 96, 96, [Windows.Media.PixelFormats]::Pbgra32)
+      $bitmap.Render($window)
+      $encoder = New-Object Windows.Media.Imaging.PngBitmapEncoder
+      $encoder.Frames.Add([Windows.Media.Imaging.BitmapFrame]::Create($bitmap))
+      $stream = [IO.File]::Open($RenderPath, [IO.FileMode]::Create)
+      try { $encoder.Save($stream) } finally { $stream.Dispose() }
+      $window.Close()
+    }
+    exit 0
+  }
+
+  $script:approved = $false
+  [void]$window.FindName('AllowButton').Focus()
+  $window.FindName('AllowButton').Add_Click({
+    $script:approved = $true
+    $window.Close()
+  })
+  $window.FindName('CancelButton').Add_Click({
+    $window.Close()
+  })
+
+  [void]$window.ShowDialog()
+  if ($script:approved) { exit 0 }
+  exit 1
+} catch {
+  Write-Error $_
+  exit 2
+}

package/codex-process.mjs

@@ -0,0 +1,43 @@
+import { spawn } from 'node:child_process';
+import { delimiter, dirname } from 'node:path';
+import process from 'node:process';
+
+export const CODEX_APP_SERVER_ARGS = [
+  'app-server',
+  '--listen',
+  'stdio://',
+  '-c',
+  'web_search="live"',
+];
+
+export function startCodexAppServer(cwd, command) {
+  const pathValue = [dirname(process.execPath), dirname(command), process.env.PATH || '']
+    .filter(Boolean)
+    .join(delimiter);
+  const options = {
+    cwd,
+    stdio: ['pipe', 'pipe', 'inherit'],
+    windowsHide: true,
+    env: { ...process.env, PATH: pathValue },
+  };
+
+  if (process.platform !== 'win32') return spawn(command, CODEX_APP_SERVER_ARGS, options);
+
+  const commandShell = process.env.ComSpec || process.env.COMSPEC || 'C:\\Windows\\System32\\cmd.exe';
+  // cmd.exe needs one outer pair of quotes around the complete /c command.
+  // windowsVerbatimArguments keeps Node from escaping those quotes.
+  const commandLine = buildWindowsCodexCommandLine(command, CODEX_APP_SERVER_ARGS);
+  return spawn(commandShell, ['/d', '/s', '/c', commandLine], {
+    ...options,
+    windowsVerbatimArguments: true,
+  });
+}
+
+export function buildWindowsCodexCommandLine(command, args = CODEX_APP_SERVER_ARGS) {
+  return '"' + [command, ...args].map(quoteWindowsArg).join(' ') + '"';
+}
+
+function quoteWindowsArg(value) {
+  // Within a cmd.exe command, embedded quotes are escaped by doubling them.
+  return '"' + String(value).replaceAll('"', '""') + '"';
+}