devlyn-cli 4.3.16 → 4.3.20

package/native/claude/skills/_shared/invocation-receipt.py

@@ -92,13 +92,16 @@ def file_prompt_args(argv):
         raise TransportError("file transport requires the sole prompt argument '-'; competing prompts are forbidden")
 
 
-def prepare_transport(prompt_path, command, argv, seconds):
-    path = pathlib.Path(prompt_path).resolve(strict=True)
-    with PLATFORM["open_stdin"](path) as source:
-        raw = source.read()
+def prepare_transport(prompt_path, seconds):
+    try:
+        path = pathlib.Path(prompt_path).resolve(strict=True)
+        with PLATFORM["open_stdin"](path) as source:
+            raw = source.read()
+    except (OSError, ValueError) as exc:
+        raise TransportError(f"DEVLYN_CODEX_PROMPT_FILE is not a readable prompt file: {prompt_path}") from exc
     record = {"schema_version": 1, "transport": "stdin-file",
               "prompt": {"path": str(path), "sha256": sha256(raw), "bytes": len(raw)},
-              "command": command, "argv": argv, "timeout_sec": seconds,
+              "timeout_sec": seconds,
               "status": "started", "exit_code": None}
     carrier = path.with_name(path.name + ".transport.json")
     if carrier.exists():
@@ -157,6 +160,7 @@ def monitor_descendant_regression() -> None:
         fake_codex = work / "fake-codex"
         fake_codex.write_text(
             f"#!{real_bash}\n"
+            "case \" $* \" in *' features list '*) for f in apps plugins remote_plugin computer_use browser_use browser_use_external in_app_browser; do printf '%s stable false\\n' \"$f\"; done; exit 0;; *' mcp list --json '*) printf '[]\\n'; exit 0;; esac\n"
             "printf '%s\\n' \"$$\" > \"$DEVLYN_WATCHDOG_TEST_CODEX_PID\"\n"
             "while [ ! -e \"$DEVLYN_WATCHDOG_TEST_RELEASE\" ]; do\n"
             "  \"$DEVLYN_WATCHDOG_TEST_REAL_SLEEP\" 0.01\n"
@@ -184,6 +188,7 @@ def monitor_descendant_regression() -> None:
             ):
                 env.pop(key)
         env.update({
+            "HOME": str(work), "USERPROFILE": str(work),
             "CODEX_BIN": str(fake_codex),
             "CODEX_MONITORED_HEARTBEAT": "1",
             "CODEX_MONITORED_TIMEOUT_SEC": "30",
@@ -411,11 +416,173 @@ def monitor_descendant_regression() -> None:
             raise
 
 
+def unattended_tools_regression():
+    with tempfile.TemporaryDirectory() as raw_tmp:
+        work = pathlib.Path(raw_tmp).resolve()
+        fake = work / "codex"
+        fake.write_text(f"#!{sys.executable}\n" + '''
+import json, os, pathlib, re, sys
+a = sys.argv[1:]
+with open("probes.jsonl", "a") as stream:
+    stream.write(json.dumps({"argv": a, "cwd": os.getcwd()}) + "\\n")
+features = "apps plugins remote_plugin computer_use browser_use browser_use_external in_app_browser".split()
+config, disabled = {}, set()
+i = 0
+while i < len(a):
+    token = a[i]
+    if token == "--": break
+    if token.startswith("-c") and not token.startswith("--") and len(token) > 2:
+        key, value = "-c", token[2:].removeprefix("=")
+    else:
+        key, equal, value = token.partition("=")
+        if key in ("-c", "--config", "--disable", "--enable", "-p", "--profile", "-C", "--cd") and not equal:
+            i += 1
+            value = a[i]
+    if key in ("-c", "--config"):
+        name, sep, val = value.partition("=")
+        if not sep: sys.exit("missing config value")
+        if name.startswith('mcp_servers."'): sys.exit("invalid transport in " + name)
+        config[name] = val
+    if key == "--disable": disabled.add(value)
+    i += 1
+if a == ["--version"]:
+    print("codex-fixture 1.2.3")
+elif a[:2] == ["features", "list"]:
+    if os.environ.get("FEATURE_FAIL"):
+        sys.exit("Unknown feature flag: in_app_browser")
+    for f in features:
+        mode = os.environ.get("FEATURE_MODE") if f == "apps" else None
+        if mode == "missing": continue
+        print(f, "under development", "garbled" if mode == "malformed" else str(mode == "sticky" or f not in disabled).lower())
+elif "mcp" in a:
+    assert a[a.index("mcp"):a.index("mcp") + 3] == ["mcp", "list", "--json"], a
+    verify = any(k.endswith(".enabled") for k in config)
+    if os.environ.get("LIST_FAIL") or (verify and os.environ.get("VERIFY_FAIL")):
+        sys.exit("cannot list servers")
+    raw = os.environ.get("VERIFY_SERVERS" if verify else "SERVERS", os.environ.get("SERVERS", '[{"name":"node_repl","enabled":true},{"name":"pyx-memory","enabled":true}]'))
+    try: servers = json.loads(raw)
+    except ValueError:
+        print(raw); sys.exit(0)
+    if isinstance(servers, list) and all(isinstance(s, dict) and "name" in s and isinstance(s.get("enabled"), bool) for s in servers):
+        servers = {s["name"]: s for s in servers}
+        for key in config:
+            match = re.fullmatch(r"mcp_servers\\.([A-Za-z0-9_-]+)\\.command", key)
+            if match:
+                name = match[1]
+                servers.setdefault(name, {"name": name, "enabled": True})
+        for key, val in config.items():
+            match = re.fullmatch(r"mcp_servers\\.([A-Za-z0-9_-]+)\\.(command|enabled)", key)
+            if match:
+                name, field = match.groups()
+                if field == "command": servers.setdefault(name, {"name": name, "enabled": True})
+                elif not os.environ.get("MCP_STICKY"):
+                    if name not in servers: sys.exit("invalid transport")
+                    servers[name]["enabled"] = val == "true"
+        servers = list(servers.values())
+    print(json.dumps(servers))
+else:
+    assert a[0] == "exec" and a[1:15] == [v for f in features for v in ("--disable", f)], a
+    pathlib.Path("seen.json").write_text(json.dumps(a))
+    pathlib.Path("stdin").write_bytes(sys.stdin.buffer.read())
+    sys.exit(int(os.environ.get("EXEC_CODE", "0")))
+''', encoding="utf-8")
+        fake.chmod(0o755)
+        wrapper = pathlib.Path(__file__).resolve().with_name("codex-monitored.sh")
+        env = {k: v for k, v in os.environ.items() if not k.startswith("CODEX_") and k != "DEVLYN_CODEX_PROMPT_FILE"}
+        env.update(HOME=str(work), USERPROFILE=str(work), CODEX_BIN=str(fake))
+        seen = work / "seen.json"
+        deny = work / ".devlyn/unattended-tools.json"
+        deny.parent.mkdir()
+
+        def launch(extra=None, code=0, args=None):
+            seen.unlink(missing_ok=True)
+            with (work / "stdout").open("wb") as stdout, (work / "stderr").open("wb") as stderr:
+                result = subprocess.run(["bash", str(wrapper), *(args or ["hello"])], cwd=work,
+                                        env={**env, **(extra or {})}, stdout=stdout, stderr=stderr, timeout=60)
+            error = (work / "stderr").read_text(encoding="utf-8")
+            assert result.returncode == code, (result.returncode, error)
+            if code == 2:
+                assert not seen.exists(), error
+            return error
+
+        launch(code=7, extra={"EXEC_CODE": "7"})
+        argv = json.loads(seen.read_text())
+        shutdown = [v for f in ("apps", "plugins", "remote_plugin", "computer_use", "browser_use",
+                                "browser_use_external", "in_app_browser") for v in ("--disable", f)]
+        assert argv == ["exec", *shutdown, "-c", "mcp_servers.node_repl.enabled=false", "hello"], argv
+        assert not any("computer-use" in a or "pyx-memory" in a for a in argv)
+        assert (work / "stdin").read_bytes() == b""
+
+        name = "desktop-custom"
+        deny.write_text(json.dumps({"codex": [name, "absent"]}), encoding="utf-8")
+        discovery = work / "project"
+        discovery.mkdir()
+        prompt = work / "prompt.md"
+        prompt.write_bytes(b"exact prompt\nsecond line\n")
+        launch(extra={"CODEX_BIN": "./codex", "SERVERS": json.dumps([{"name": name, "enabled": True}]),
+                      "DEVLYN_CODEX_PROMPT_FILE": str(prompt)},
+               args=["-C", str(discovery), "--config=model_reasoning_effort=high", "--", "-"])
+        argv = json.loads(seen.read_text())
+        assert f"mcp_servers.{name}.enabled=false" in argv, argv
+        assert not any("absent" in a or "node_repl" in a for a in argv)
+        assert argv[-2:] == ["--", "-"] and (work / "stdin").read_bytes() == prompt.read_bytes()
+        receipt = json.loads(prompt.with_name("prompt.md.transport.json").read_text())
+        assert receipt["command"] == ["./codex", *argv] and receipt["status"] == "completed"
+        probes = [json.loads(line) for line in (discovery / "probes.jsonl").read_text().splitlines()]
+        listing = [p for p in probes if "mcp" in p["argv"]][-1]
+        assert listing["cwd"] == str(discovery) and "model_reasoning_effort=high" in listing["argv"], listing
+
+        deny.write_text(json.dumps({"codex": ["desktop.quoted"]}), encoding="utf-8")
+        assert "desktop.quoted" in launch({"SERVERS": '[{"name":"desktop.quoted","enabled":true}]'}, code=2)
+        deny.unlink()
+        # Every accepted spelling reaches discovery, without moving or altering caller argv.
+        for option, value in (("-c", 'mcp_servers.node_repl.command="echo"'), ("--config", 'mcp_servers.node_repl.command="echo"'),
+                              ("-p", "fixture"), ("--profile", "fixture"), ("--enable", "hooks"), ("--disable", "hooks"),
+                              ("-C", str(discovery)), ("--cd", str(discovery))):
+            forms = [[option, value], [option + "=" + value]]
+            if option in {"-c", "-p", "-C"}:
+                forms.append([option + value])
+            for form in forms:
+                for log in (work / "probes.jsonl", discovery / "probes.jsonl"):
+                    log.unlink(missing_ok=True)
+                launch(args=[*form, "--", "prompt"], extra={"SERVERS": '[]'})
+                actual = json.loads(seen.read_text())
+                assert actual[-len(form) - 2:] == [*form, "--", "prompt"], actual
+                directory = discovery if option in {"-C", "--cd"} else work
+                probes = [json.loads(line) for line in (directory / "probes.jsonl").read_text().splitlines()]
+                listings = [p for p in probes if "mcp" in p["argv"]]
+                assert len(listings) == 2, listings
+                for listing in listings:
+                    assert listing["cwd"] == str(directory), listing
+                    if option not in {"-C", "--cd"}:
+                        assert [option, value] in [listing["argv"][i:i + 2] for i in range(len(listing["argv"]) - 1)], listing
+                if option in {"-c", "--config"}:
+                    assert "mcp_servers.node_repl.enabled=false" in actual, actual
+
+        for mode in ("sticky", "missing", "malformed"):
+            assert "Codex feature" in launch({"FEATURE_MODE": mode}, code=2)
+        assert "overrides did not disable" in launch({"MCP_STICKY": "1"}, code=2)
+        assert "overrides did not disable" in launch(args=["-c", "mcp_servers.node_repl.enabled=true", "hello"], code=2)
+        assert "cannot list servers" in launch({"VERIFY_FAIL": "1"}, code=2)
+        assert "malformed Codex mcp list" in launch({"VERIFY_SERVERS": "not json"}, code=2)
+
+        for bad in ('{', '[]', '{"codex": "x"}', '{"claude": [1]}', '{"codex":[],"codex":[]}'):
+            deny.write_text(bad, encoding="utf-8")
+            assert str(deny) in launch(code=2)
+        deny.unlink()
+        assert "codex-fixture 1.2.3" in launch({"FEATURE_FAIL": "1"}, code=2)
+        assert "cannot list servers" in launch({"LIST_FAIL": "1"}, code=2)
+        for bad in ('not json', '{}', '[{}]', '[{"name":"node_repl","enabled":"true"}]'):
+            assert "malformed Codex mcp list" in launch({"SERVERS": bad}, code=2)
+    print("PASS unattended Codex defaults, discovery, receipts and fail-closed refusals")
+
+
 def self_test() -> int:
     monitor_descendant_regression()
     if os.name == "nt":
         print("SKIP POSIX executable-shell wrapper fixture; native npm transport is covered by test-windows-portability.py")
         return 0
+    unattended_tools_regression()
     with tempfile.TemporaryDirectory() as raw_tmp:
         work = pathlib.Path(raw_tmp)
         fake_codex = work / "fake-codex"
@@ -442,17 +609,20 @@ def complete_dispatch(exit_code):
 
 def dispatch_codex(args):
     argv = args.argv[1:] if args.argv[:1] == ["--"] else args.argv
-    command = [args.binary, "exec", *argv]
-    actual = PLATFORM["native_argv"](command)
     prompt = os.environ.get("DEVLYN_CODEX_PROMPT_FILE")
     if prompt == "":
         raise TransportError("DEVLYN_CODEX_PROMPT_FILE must name a readable prompt file")
+    if prompt:
+        file_prompt_args(argv)
     stream, carrier, transport = None, None, None
     try:
         if prompt:
-            file_prompt_args(argv)
-            stream, carrier, transport = prepare_transport(prompt, command, actual, args.timeout)
+            stream, carrier, transport = prepare_transport(prompt, args.timeout)
+        argv = runpy.run_path(str(pathlib.Path(__file__).with_name("unattended-tools.py")))["codex_launch"](args.binary, argv)
+        command = [args.binary, "exec", *argv]
+        actual = PLATFORM["native_argv"](command)
         if transport is not None:
+            transport.update(command=command, argv=actual)
             write_transport(carrier, transport)
         if os.name != "nt":
             if stream is not None:

package/native/claude/skills/_shared/platform-support.py

@@ -6,6 +6,7 @@ import contextlib
 import errno
 import os
 from pathlib import Path
+import platform
 import re
 import shutil
 import signal
@@ -81,7 +82,14 @@ NPM_CLI = re.compile(r'SET "(NP[MX]_CLI_JS)=%~dp0\\([^"\r\n]+)"')
 
 def native_argv(argv, cwd=None):
     """Resolve argv as Windows does, for a command that will run in cwd; a Node command shim runs its Node and script
-    directly, never cmd /c."""
+    directly, never cmd /c; on macOS avoid kernel #! exec, whose process tree keeps kernel memory for each later
+    #! exec until restart."""
+    if sys.platform == "darwin":
+        try:
+            prefix = darwin_script_argv(argv[0], cwd or os.getcwd())
+            return [*prefix, *argv[1:]] if prefix else list(argv)
+        except (OSError, ValueError, TypeError, NotImplementedError, IndexError):
+            return list(argv)  # Preserve CPython's PATH search and errors without a shell fallback.
     if os.name != "nt":
         return list(argv)
     binary = shutil.which(argv[0])
@@ -100,6 +108,99 @@ def native_argv(argv, cwd=None):
     return [node, str(script.resolve(strict=True)), *argv[1:]]
 
 
+def darwin_script_argv(program, cwd):
+    """The argv prefix macOS would build for a safely resolved script with a native interpreter, else None.
+
+    Search with CPython's os.get_exec_path(), including os.defpath when PATH is unset. A CPU-compatible
+    interpreter with an otherwise damaged image fails against the interpreter instead of retrying PATH.
+    The interpreter path is executed as it is at exec time: replacing it requires write access that
+    already lets the writer run code as the user. A set-id replacement owned by another user cannot
+    raise privilege; only root can create root-owned set-id files. Quarantined scripts are declined;
+    other exec-only MAC policies that permit reading but deny executing the script are not consulted.
+    """
+    cpu = {"arm64": 0x0100000c, "x86_64": 0x01000007}.get(platform.machine())
+    if cpu is None:
+        return None
+    subtypes = (0, 1, 2) if cpu == 0x0100000c else (3,)
+    entries = [None] if "/" in program else os.get_exec_path()
+    with contextlib.ExitStack() as handles:
+        try:
+            cwd_fd = os.open(cwd, os.O_RDONLY | os.O_DIRECTORY)
+            handles.callback(os.close, cwd_fd)
+            for entry in entries:
+                if entry is not None and len(os.fsencode(entry)) + len(os.fsencode(program)) + 2 > 1024:
+                    return None
+                candidate = program if entry is None else os.path.join(entry, program)
+                try:
+                    mode = os.stat(candidate, dir_fd=cwd_fd).st_mode
+                except (FileNotFoundError, NotADirectoryError):
+                    continue
+                if not stat.S_ISREG(mode) or not os.access(candidate, os.X_OK, dir_fd=cwd_fd, effective_ids=True):
+                    continue
+                with os.fdopen(os.open(candidate, os.O_RDONLY | os.O_NONBLOCK, dir_fd=cwd_fd), "rb") as stream:
+                    mode = os.fstat(stream.fileno()).st_mode
+                    if not stat.S_ISREG(mode) or mode & (stat.S_ISUID | stat.S_ISGID):
+                        return None
+                    try:
+                        if hasattr(os, "getxattr"):
+                            os.getxattr(stream.fileno(), "com.apple.quarantine")
+                        else:
+                            # CPython exposes os.getxattr on Linux, but macOS needs its native fd API.
+                            import ctypes
+                            getxattr = ctypes.CDLL(None, use_errno=True).fgetxattr
+                            getxattr.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_void_p, ctypes.c_size_t,
+                                                ctypes.c_uint32, ctypes.c_int]
+                            getxattr.restype = ctypes.c_ssize_t
+                            if getxattr(stream.fileno(), b"com.apple.quarantine", None, 0, 0, 0) < 0:
+                                error = ctypes.get_errno()
+                                raise OSError(error, os.strerror(error))
+                    except OSError as exc:
+                        if exc.errno != getattr(errno, "ENOATTR", None):
+                            return None
+                    else:
+                        return None
+                    header = stream.read(512)
+                if not header.startswith(b"#!"):
+                    return None
+                line = re.split(b"[#\n]", header[2:], maxsplit=1)
+                if len(line) != 2:
+                    return None
+                words = re.split(b"[ \t]+", line[0].strip(b" \t"))
+                if b"\0" in line[0] or not words[0].startswith(b"/"):
+                    return None
+                interpreter = os.fsdecode(words[0])
+                mode = os.stat(interpreter).st_mode
+                if (not stat.S_ISREG(mode) or mode & (stat.S_ISUID | stat.S_ISGID)
+                        or not os.access(interpreter, os.X_OK, effective_ids=True)):
+                    return None
+                with open_stdin(interpreter) as stream:
+                    image = stream.read(512)
+                magic = int.from_bytes(image[:4], "big")
+                if magic not in (0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe,
+                                 0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca):
+                    return None
+                order = "little" if magic in (0xcefaedfe, 0xcffaedfe, 0xbebafeca, 0xbfbafeca) else "big"
+                if magic in (0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe):
+                    size = 32 if magic in (0xfeedfacf, 0xcffaedfe) else 28
+                    if (len(image) < size or int.from_bytes(image[4:8], order) != cpu
+                            or int.from_bytes(image[8:12], order) & ~0xff000000 not in subtypes):
+                        return None
+                else:
+                    count = int.from_bytes(image[4:8], order)
+                    size = 32 if magic in (0xcafebabf, 0xbfbafeca) else 20
+                    if len(image) < 8 or count > (len(image) - 8) // size:
+                        return None
+                    if not any(int.from_bytes(image[8 + i * size:12 + i * size], order) == cpu
+                               and int.from_bytes(image[12 + i * size:16 + i * size], order) & ~0xff000000 in subtypes
+                               for i in range(count)):
+                        return None
+                return [*map(os.fsdecode, words), candidate]
+        except (OSError, ValueError, TypeError, NotImplementedError):
+            # Preserve the original exec, including PATH retries, whenever inspection is uncertain.
+            return None
+    return None
+
+
 def shim_script(shim, raw, node, cwd=None):
     """The script a Node command shim runs, as cmd.exe would resolve it, else None: the one target of an npm, pnpm
     or corepack cmd-shim that sets no environment, or for Node.js's own npm.cmd and npx.cmd the global prefix's