cyrus-codex-runner 0.2.73 → 0.2.75
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/config/CodexConfigBuilder.d.ts.map +1 -1
- package/dist/config/CodexConfigBuilder.js +4 -1
- package/dist/config/CodexConfigBuilder.js.map +1 -1
- package/dist/config/sandboxPolicy.d.ts +3 -3
- package/dist/config/sandboxPolicy.d.ts.map +1 -1
- package/dist/config/sandboxPolicy.js +14 -18
- package/dist/config/sandboxPolicy.js.map +1 -1
- package/dist/types.d.ts +6 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +6 -6
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"CodexConfigBuilder.d.ts","sourceRoot":"","sources":["../../src/config/CodexConfigBuilder.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAGX,iBAAiB,EACjB,MAAM,aAAa,CAAC;AAWrB;;;;;GAKG;AACH,qBAAa,kBAAkB;IAClB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,iBAAiB,EAAI;IAEpD,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAkC1C;IAED;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,wBAAwB;
|
|
1
|
+
{"version":3,"file":"CodexConfigBuilder.d.ts","sourceRoot":"","sources":["../../src/config/CodexConfigBuilder.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAGX,iBAAiB,EACjB,MAAM,aAAa,CAAC;AAWrB;;;;;GAKG;AACH,qBAAa,kBAAkB;IAClB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,iBAAiB,EAAI;IAEpD,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAkC1C;IAED;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,wBAAwB;IAehC,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IA6B5B;;;;OAIG;YACW,wBAAwB;YAqCxB,oBAAoB;CAuBlC"}
|
|
@@ -66,7 +66,10 @@ export class CodexConfigBuilder {
|
|
|
66
66
|
getAdditionalDirectories() {
|
|
67
67
|
const workingDirectory = this.config.workingDirectory;
|
|
68
68
|
const uniqueDirectories = new Set();
|
|
69
|
-
for (const directory of
|
|
69
|
+
for (const directory of [
|
|
70
|
+
...(this.config.allowedDirectories || []),
|
|
71
|
+
...(this.config.writableRoots || []),
|
|
72
|
+
]) {
|
|
70
73
|
if (!directory || directory === workingDirectory) {
|
|
71
74
|
continue;
|
|
72
75
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"CodexConfigBuilder.js","sourceRoot":"","sources":["../../src/config/CodexConfigBuilder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,SAAS,iCAAiC,CACzC,KAAc;IAEd,4EAA4E;IAC5E,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACD,MAAM;IAAnC,YAA6B,MAAyB;sBAAzB,MAAM;IAAsB,CAAC;IAE1D,KAAK,CAAC,KAAK;QACV,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,eAAe,GACpB,IAAI,CAAC,MAAM,CAAC,oBAAoB;YAChC,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,aAAa,GAClB,IAAI,CAAC,MAAM,CAAC,aAAa;YACzB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAErD,OAAO;YACN,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,mBAAmB,CAAC;gBAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,iBAAiB;gBAC9C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,IAAI,CAAC,wBAAwB,EAAE;gBAC9C,aAAa,EAAE,IAAI,CAAC,oBAAoB,EAAE;gBAC1C,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;aAC5C,CAAC;YACF,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,OAAO;YACrD,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACtD,oBAAoB,EAAE,eAAe;YACrC,aAAa;YACb,qBAAqB,EACpB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;YAC3D,eAAe,EAAE,IAAI,CAAC,oBAAoB,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACrC,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;SAC5C,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,oBAAoB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,uBAAuB,CAAC;QACjE,IACC,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnB,OAAQ,GAAoC,CAAC,cAAc,KAAK,SAAS,EACxE,CAAC;YACF,OAAQ,GAAmC,CAAC,cAAc,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,wBAAwB;QAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"CodexConfigBuilder.js","sourceRoot":"","sources":["../../src/config/CodexConfigBuilder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,SAAS,iCAAiC,CACzC,KAAc;IAEd,4EAA4E;IAC5E,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACD,MAAM;IAAnC,YAA6B,MAAyB;sBAAzB,MAAM;IAAsB,CAAC;IAE1D,KAAK,CAAC,KAAK;QACV,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,eAAe,GACpB,IAAI,CAAC,MAAM,CAAC,oBAAoB;YAChC,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,aAAa,GAClB,IAAI,CAAC,MAAM,CAAC,aAAa;YACzB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAErD,OAAO;YACN,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,mBAAmB,CAAC;gBAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,iBAAiB;gBAC9C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,IAAI,CAAC,wBAAwB,EAAE;gBAC9C,aAAa,EAAE,IAAI,CAAC,oBAAoB,EAAE;gBAC1C,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;aAC5C,CAAC;YACF,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,OAAO;YACrD,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACtD,oBAAoB,EAAE,eAAe;YACrC,aAAa;YACb,qBAAqB,EACpB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;YAC3D,eAAe,EAAE,IAAI,CAAC,oBAAoB,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACrC,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;SAC5C,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,oBAAoB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,uBAAuB,CAAC;QACjE,IACC,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnB,OAAQ,GAAoC,CAAC,cAAc,KAAK,SAAS,EACxE,CAAC;YACF,OAAQ,GAAmC,CAAC,cAAc,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,wBAAwB;QAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,KAAK,MAAM,SAAS,IAAI;YACvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;SACpC,EAAE,CAAC;YACH,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;gBAClD,SAAS;YACV,CAAC;YACD,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IAEO,gBAAgB;QACvB,MAAM,SAAS,GACd,IAAI,CAAC,MAAM,CAAC,SAAS;YACrB,OAAO,CAAC,GAAG,CAAC,UAAU;YACtB,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,gBAAgB,CACvB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClB,CAAC;QACF,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;QAC3B,OAAO,GAAG,CAAC;IACZ,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB;QAC3B,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GACnD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;QACnC,MAAM,eAAe,GAAyB,EAAE,GAAG,IAAI,EAAE,CAAC;QAE1D,MAAM,UAAU,GAAG,0BAA0B,CAAC;YAC7C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;SACtC,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,kBAAkB,GAAG,eAAe,CAAC,WAAW,CAAC;YACvD,eAAe,CAAC,WAAW;gBAC1B,kBAAkB;oBAClB,OAAO,kBAAkB,KAAK,QAAQ;oBACtC,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC;oBACjC,CAAC,CAAC;wBACA,GAAI,kBAAuD;wBAC3D,GAAG,UAAU;qBACb;oBACF,CAAC,CAAC,UAAU,CAAC;QAChB,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC;YAC7C,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,SAAS,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO;QAEtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,MAAM,IAAI,CAAC,oBAAoB,EAAE;YAAE,OAAO;QAE9C,MAAM,OAAO,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,2BAA2B,CAC3B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEtB,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC3B,GAAG,OAAO,WAAW,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAChD;gBACC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;gBAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACnC,CACD,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CACV,wBAAwB,KAAK,uCAAuC,QAAQ,GAAG,CAC/E,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC;YAC9B,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qEAAqE;YACrE,8CAA8C;QAC/C,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,oBAAoB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC;QAClD,IAAI,CAAC;YACJ,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACxD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7C,QAAQ,EACR,CAAC,OAAO,EAAE,QAAQ,CAAC,EACnB,EAAE,OAAO,EAAE,KAAK,EAAE,CAClB,CAAC;YACF,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,CACV,uCAAuC,MAAM,cAAc,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAClI,CAAC;YACF,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CACX,+DAA+D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvH,CAAC;YACF,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;CACD"}
|
|
@@ -33,9 +33,9 @@ export interface SandboxResolveInput {
|
|
|
33
33
|
/**
|
|
34
34
|
* Resolve the per-thread sandbox decision.
|
|
35
35
|
*
|
|
36
|
-
* -
|
|
37
|
-
*
|
|
38
|
-
* - `sandboxSettings`
|
|
36
|
+
* - Explicit read-only/full-access modes or no `sandboxSettings` use the
|
|
37
|
+
* corresponding native Codex mode.
|
|
38
|
+
* - Workspace-write with `sandboxSettings` uses a granular `profile` that restricts
|
|
39
39
|
* reads to an allow-list (worktree + platform defaults + explicit reads) and
|
|
40
40
|
* writes to the worktree + explicit writable roots.
|
|
41
41
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandboxPolicy.d.ts","sourceRoot":"","sources":["../../src/config/sandboxPolicy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAEX,oBAAoB,EACpB,MAAM,qBAAqB,CAAC;AAE7B,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACtC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IACnC,wEAAwE;IACxE,IAAI,EAAE,WAAW,CAAC;IAClB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,iFAAiF;IACjF,eAAe,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,mBAAmB,GACxB,oBAAoB,
|
|
1
|
+
{"version":3,"file":"sandboxPolicy.d.ts","sourceRoot":"","sources":["../../src/config/sandboxPolicy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAEX,oBAAoB,EACpB,MAAM,qBAAqB,CAAC;AAE7B,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACtC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IACnC,wEAAwE;IACxE,IAAI,EAAE,WAAW,CAAC;IAClB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,iFAAiF;IACjF,eAAe,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,mBAAmB,GACxB,oBAAoB,CA2CtB"}
|
|
@@ -7,15 +7,17 @@ function uniqueAbsolute(paths) {
|
|
|
7
7
|
/**
|
|
8
8
|
* Resolve the per-thread sandbox decision.
|
|
9
9
|
*
|
|
10
|
-
* -
|
|
11
|
-
*
|
|
12
|
-
* - `sandboxSettings`
|
|
10
|
+
* - Explicit read-only/full-access modes or no `sandboxSettings` use the
|
|
11
|
+
* corresponding native Codex mode.
|
|
12
|
+
* - Workspace-write with `sandboxSettings` uses a granular `profile` that restricts
|
|
13
13
|
* reads to an allow-list (worktree + platform defaults + explicit reads) and
|
|
14
14
|
* writes to the worktree + explicit writable roots.
|
|
15
15
|
*/
|
|
16
16
|
export function resolveCodexSandbox(input) {
|
|
17
17
|
const { mode, workingDirectory, writableRoots, networkAccess } = input;
|
|
18
|
-
|
|
18
|
+
// Explicit native modes take precedence over generated filesystem profiles.
|
|
19
|
+
// A root-writable profile still applies OS sandbox restrictions on macOS.
|
|
20
|
+
if (!input.sandboxSettings || mode !== "workspace-write") {
|
|
19
21
|
return {
|
|
20
22
|
kind: "workspace-mode",
|
|
21
23
|
mode,
|
|
@@ -32,20 +34,14 @@ export function resolveCodexSandbox(input) {
|
|
|
32
34
|
const writableAbs = uniqueAbsolute([...writableRoots, ...allowWrite]).filter((p) => p !== cwd);
|
|
33
35
|
// Readable-only roots: explicit reads not already writable / the worktree.
|
|
34
36
|
const readableAbs = uniqueAbsolute(allowRead).filter((p) => p !== cwd && !writableAbs.includes(p));
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
":workspace_roots": workspaceAccess,
|
|
44
|
-
":tmpdir": "write",
|
|
45
|
-
":slash_tmp": "write",
|
|
46
|
-
...Object.fromEntries(writableAbs.map((p) => [p, "write"])),
|
|
47
|
-
...Object.fromEntries(readableAbs.map((p) => [p, "read"])),
|
|
48
|
-
};
|
|
37
|
+
const filesystem = {
|
|
38
|
+
":minimal": "read",
|
|
39
|
+
":workspace_roots": "write",
|
|
40
|
+
":tmpdir": "write",
|
|
41
|
+
":slash_tmp": "write",
|
|
42
|
+
...Object.fromEntries(writableAbs.map((p) => [p, "write"])),
|
|
43
|
+
...Object.fromEntries(readableAbs.map((p) => [p, "read"])),
|
|
44
|
+
};
|
|
49
45
|
return {
|
|
50
46
|
kind: "profile",
|
|
51
47
|
profileId: CYRUS_SANDBOX_PROFILE_ID,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandboxPolicy.js","sourceRoot":"","sources":["../../src/config/sandboxPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,oEAAoE;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAgCxD,SAAS,cAAc,CAAC,KAAe;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAEvE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"sandboxPolicy.js","sourceRoot":"","sources":["../../src/config/sandboxPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,oEAAoE;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAgCxD,SAAS,cAAc,CAAC,KAAe;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAEvE,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1D,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI;YACJ,aAAa,EAAE,cAAc,CAAC;gBAC7B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,aAAa;aAChB,CAAC;YACF,aAAa;SACb,CAAC;IACH,CAAC;IAED,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC;IAC7B,iFAAiF;IACjF,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAChB,CAAC;IACF,2EAA2E;IAC3E,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,MAAM,CACnD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5C,CAAC;IAEF,MAAM,UAAU,GAA0C;QACzD,UAAU,EAAE,MAAM;QAClB,kBAAkB,EAAE,OAAO;QAC3B,SAAS,EAAE,OAAO;QAClB,YAAY,EAAE,OAAO;QACrB,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAgB,CAAC,CAAC,CAAC;QACpE,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAe,CAAC,CAAC,CAAC;KACnE,CAAC;IAEF,OAAO;QACN,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,wBAAwB;QACnC,UAAU;QACV,aAAa;KACb,CAAC;AACH,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -43,6 +43,12 @@ export interface CodexRunnerConfig extends AgentRunnerConfig {
|
|
|
43
43
|
* coarse default mode. Paths must be absolute.
|
|
44
44
|
*/
|
|
45
45
|
sandboxSettings?: CyrusSandboxFilesystem;
|
|
46
|
+
/**
|
|
47
|
+
* Extra absolute paths made writable on top of the worktree (operator
|
|
48
|
+
* whitelist, e.g. `~/.supabase`). Applied in both the default
|
|
49
|
+
* workspace-write mode and the granular `sandboxSettings` profile.
|
|
50
|
+
*/
|
|
51
|
+
writableRoots?: string[];
|
|
46
52
|
}
|
|
47
53
|
/**
|
|
48
54
|
* Session metadata for CodexRunner.
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,MAAM,gBAAgB,GACzB,MAAM,GACN,MAAM,GACN,OAAO,GACP,gBAAgB,EAAE,GAClB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,oBAAoB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC3D,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,kDAAkD;IAClD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,qDAAqD;IACrD,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,MAAM,gBAAgB,GACzB,MAAM,GACN,MAAM,GACN,OAAO,GACP,gBAAgB,EAAE,GAClB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,oBAAoB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC3D,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,kDAAkD;IAClD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,qDAAqD;IACrD,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACzD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC9B,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,IAAI,CAAC;CAC3C"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cyrus-codex-runner",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.75",
|
|
4
4
|
"description": "Codex CLI process wrapper for Cyrus",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -14,15 +14,15 @@
|
|
|
14
14
|
"dist"
|
|
15
15
|
],
|
|
16
16
|
"dependencies": {
|
|
17
|
-
"@openai/codex": "^0.
|
|
18
|
-
"@openai/codex-sdk": "^0.
|
|
19
|
-
"cyrus-core": "0.2.
|
|
20
|
-
"cyrus-simple-agent-runner": "0.2.
|
|
17
|
+
"@openai/codex": "^0.159.2",
|
|
18
|
+
"@openai/codex-sdk": "^0.159.2",
|
|
19
|
+
"cyrus-core": "0.2.75",
|
|
20
|
+
"cyrus-simple-agent-runner": "0.2.75"
|
|
21
21
|
},
|
|
22
22
|
"devDependencies": {
|
|
23
23
|
"@types/node": "^20.0.0",
|
|
24
24
|
"@typescript/native-preview": "7.0.0-dev.20260707.2",
|
|
25
|
-
"vitest": "^4.1.
|
|
25
|
+
"vitest": "^4.1.12"
|
|
26
26
|
},
|
|
27
27
|
"publishConfig": {
|
|
28
28
|
"access": "public"
|