humanish 0.104.3 → 0.106.0

package/dist/actors/codex/restricted-policy.js

@@ -0,0 +1,326 @@
+/** Versioned, deliberately narrow profile qualified with an account-backed vision turn.
+ * The CLI still advertises code-mode tools: disabling their host is the enforcement
+ * boundary. Feature names alone are not proof that a tool has been removed. The admitted
+ * CLI releases are per host, in qualified-versions.ts. */
+export const RESTRICTED_CODEX_ANALYSIS_IDENTITY = {
+    provider: "codex",
+    authMode: "chatgpt",
+    modelProvider: "openai",
+    toolPolicy: "restricted-codex-v1",
+    reasoningEffort: "low",
+};
+export const RESTRICTED_CODEX_ANALYSIS_MODELS = ["gpt-6-astra"];
+export const CODEX_MAX_REQUEST_BYTES = 32 * 1024 * 1024;
+export const CODEX_MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
+export const CODEX_MAX_STDOUT_BYTES = 8 * 1024 * 1024;
+export const CODEX_MAX_EVENTS = 65_536;
+export const CODEX_IMAGE = /^data:image\/(png|jpeg|webp);base64,([A-Za-z0-9+/]+={0,2})$/;
+export const codexRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : {};
+const empty = (value) => value === null ||
+    value === undefined ||
+    (typeof value === "object" && Object.keys(value).length === 0);
+const count = (value) => Number.isSafeInteger(value) && value >= 0 && value <= 1e12;
+const disabledFeatures = [
+    "apps",
+    "plugins",
+    "hooks",
+    "shell_tool",
+    "shell_snapshot",
+    "view_image",
+    "image_generation",
+    "skill_search",
+    "skill_mcp_dependency_install",
+    "multi_agent",
+    "multi_agent_v2",
+    "browser_use",
+    "browser_use_external",
+    "computer_use",
+    "memories",
+    "external_agent_memory_import",
+    "goals",
+    "sleep_tool",
+    "tool_suggest",
+    "default_mode_request_user_input",
+    "unbounded_connection_retries",
+    "workspace_dependencies",
+    "remote_plugin",
+    "recommended_plugins",
+    "in_app_local_automation",
+];
+const codeModeFeatures = ["code_mode", "code_mode_host", "code_mode_only"];
+export function restrictedCodexConfig(model, mode = {}) {
+    const reasoningEffort = mode.reasoningEffort ?? "low", codeMode = mode.participantCodeMode === true;
+    const overrides = {
+        model_provider: "openai",
+        model_reasoning_effort: reasoningEffort,
+        approval_policy: "never",
+        sandbox_mode: "read-only",
+        project_doc_max_bytes: 0,
+        web_search: "disabled",
+        "history.persistence": "none",
+        "analytics.enabled": false,
+        "features.skip_host_skill_discovery": true,
+        "skills.bundled.enabled": false,
+        "agents.enabled": false,
+        "agents.max_threads": 1,
+        "agents.max_depth": 1,
+    };
+    if (model !== undefined)
+        overrides.model = model;
+    if (!mode.operatorAuth)
+        overrides.forced_login_method = "chatgpt";
+    for (const name of disabledFeatures)
+        overrides[`features.${name}`] = false;
+    for (const name of codeModeFeatures)
+        overrides[`features.${name}`] = codeMode;
+    const toml = `${model === undefined ? "" : `model = ${JSON.stringify(model)}\n`}model_provider = "openai"
+model_reasoning_effort = ${JSON.stringify(reasoningEffort)}
+approval_policy = "never"
+sandbox_mode = "read-only"
+${mode.operatorAuth ? "" : 'forced_login_method = "chatgpt"\n'}project_doc_max_bytes = 0
+web_search = "disabled"
+[history]
+persistence = "none"
+[analytics]
+enabled = false
+[features]
+skip_host_skill_discovery = true
+${disabledFeatures.map((name) => `${name} = false`).join("\n")}
+${codeModeFeatures.map((name) => `${name} = ${codeMode}`).join("\n")}
+[skills.bundled]
+enabled = false
+[agents]
+enabled = false
+max_threads = 1
+max_depth = 1
+`;
+    return { toml, overrides };
+}
+/** Inspect before thread/start, which could otherwise start inherited integrations. */
+export function admitsRestrictedCodexConfig(raw, configPath, model, mode = {}) {
+    const root = codexRecord(raw), config = codexRecord(root.config), features = codexRecord(config.features);
+    if (!Array.isArray(root.layers) || root.layers.length === 0)
+        return false;
+    if (!mode.operatorAuth) {
+        let ownLayer = false;
+        for (const rawLayer of root.layers) {
+            const layer = codexRecord(rawLayer), name = codexRecord(layer.name);
+            if (name.type === "user" &&
+                name.file === configPath &&
+                name.profile === null &&
+                (layer.disabledReason === null || layer.disabledReason === undefined)) {
+                if (ownLayer)
+                    return false;
+                ownLayer = true;
+            }
+            else if (name.type !== "system" || !empty(layer.config))
+                return false;
+        }
+        if (!ownLayer)
+            return false;
+    }
+    const reasoningEffort = mode.reasoningEffort ?? "low", codeMode = mode.participantCodeMode === true;
+    const inheritedModel = config.model;
+    const modelAdmitted = model === undefined && mode.operatorAuth
+        ? inheritedModel === undefined ||
+            inheritedModel === null ||
+            (typeof inheritedModel === "string" &&
+                inheritedModel.length > 0 &&
+                inheritedModel.length <= 200)
+        : inheritedModel === model;
+    if (!modelAdmitted ||
+        config.model_provider !== "openai" ||
+        config.model_reasoning_effort !== reasoningEffort ||
+        (!mode.operatorAuth && config.forced_login_method !== "chatgpt") ||
+        config.sandbox_mode !== "read-only" ||
+        config.approval_policy !== "never" ||
+        config.project_doc_max_bytes !== 0 ||
+        config.web_search !== "disabled" ||
+        features.skip_host_skill_discovery !== true ||
+        codexRecord(config.history).persistence !== "none" ||
+        codexRecord(config.analytics).enabled !== false ||
+        disabledFeatures.some((name) => features[name] !== false) ||
+        codeModeFeatures.some((name) => features[name] !== codeMode))
+        return false;
+    const agents = codexRecord(config.agents), skills = codexRecord(config.skills);
+    if (agents.enabled !== false ||
+        agents.max_concurrent_threads_per_session !== 1 ||
+        agents.max_depth !== 1 ||
+        codexRecord(skills.bundled).enabled !== false ||
+        Object.keys(skills).some((key) => key !== "bundled"))
+        return false;
+    if (!mode.operatorAuth) {
+        for (const key of [
+            "mcp_servers",
+            "plugins",
+            "hooks",
+            "notify",
+            "instructions",
+            "developer_instructions",
+            "permissions",
+            "profiles",
+            "projects",
+            "model_providers",
+            "experimental_compact_prompt_file",
+            "experimental_model_instructions_file",
+            "model_instructions_file",
+            "model_catalog_json",
+            "openai_base_url",
+            "orchestrator",
+            "experimental_thread_store",
+            "experimental_thread_store_endpoint",
+            "experimental_realtime_ws_base_url",
+            "experimental_realtime_webrtc_call_base_url",
+            "forced_chatgpt_workspace_id",
+            "log_dir",
+            "sqlite_home",
+            "otel",
+            "marketplaces",
+            "js_repl_node_path",
+            "js_repl_node_module_dirs",
+            "responses_api_metadata",
+            "compact_prompt",
+            "profile",
+            "default_permissions",
+            "auto_review",
+            "apps",
+            "browser_use",
+            "computer_use",
+            "desktop",
+            "memories",
+            "realtime",
+        ])
+            if (!empty(config[key]))
+                return false;
+        if (Object.values(codexRecord(config.shell_environment_policy)).some((value) => !empty(value)))
+            return false;
+    }
+    return (mode.operatorAuth ||
+        (config.cli_auth_credentials_store === "file" &&
+            config.chatgpt_base_url === "https://chatgpt.com/backend-api/"));
+}
+export function admitsRestrictedCodexThread(raw, model, cwd, reasoningEffort, cliVersion) {
+    const value = codexRecord(raw), thread = codexRecord(value.thread), sandbox = codexRecord(value.sandbox);
+    return (typeof thread.id === "string" &&
+        thread.id.length > 0 &&
+        thread.id.length <= 200 &&
+        thread.ephemeral === true &&
+        thread.model === model &&
+        thread.modelProvider === "openai" &&
+        thread.reasoningEffort === reasoningEffort &&
+        thread.cliVersion === cliVersion &&
+        Array.isArray(thread.environments) &&
+        thread.environments.length === 0 &&
+        thread.path === null &&
+        value.model === model &&
+        value.modelProvider === "openai" &&
+        value.reasoningEffort === reasoningEffort &&
+        value.cwd === cwd &&
+        thread.cwd === cwd &&
+        value.approvalPolicy === "never" &&
+        sandbox.type === "readOnly" &&
+        sandbox.networkAccess === false &&
+        Array.isArray(value.instructionSources) &&
+        value.instructionSources.length === 0 &&
+        Array.isArray(value.runtimeWorkspaceRoots) &&
+        value.runtimeWorkspaceRoots.length === 0);
+}
+export function restrictedCodexRequestError(request, operatorParticipant = false) {
+    if (request.signal?.aborted)
+        return "cancelled";
+    if (operatorParticipant) {
+        if (request.model !== undefined &&
+            (typeof request.model !== "string" ||
+                request.model.length === 0 ||
+                request.model.length > 200))
+            return "codex_model_unavailable";
+    }
+    else if (!RESTRICTED_CODEX_ANALYSIS_MODELS.some((model) => model === request.model))
+        return "codex_model_unavailable";
+    if (request.maxOutputTokens !== null ||
+        !Number.isSafeInteger(request.timeoutMs) ||
+        request.timeoutMs < 1 ||
+        request.timeoutMs > 600_000 ||
+        typeof request.instructions !== "string" ||
+        typeof request.evidence !== "string" ||
+        !Array.isArray(request.images) ||
+        request.images.length > 128 ||
+        !request.schema ||
+        typeof request.schema !== "object" ||
+        Array.isArray(request.schema))
+        return "invalid_request";
+    try {
+        if (new TextEncoder().encode(JSON.stringify({
+            instructions: request.instructions,
+            evidence: request.evidence,
+            images: request.images,
+            schema: request.schema,
+        })).byteLength > CODEX_MAX_REQUEST_BYTES)
+            return "invalid_request";
+        let imageBytes = 0;
+        for (const image of request.images) {
+            if (typeof image.evidenceId !== "string" ||
+                image.evidenceId.length === 0 ||
+                image.evidenceId.length > 300 ||
+                typeof image.dataUrl !== "string")
+                return "invalid_request";
+            const match = CODEX_IMAGE.exec(image.dataUrl);
+            if (!match)
+                return "invalid_request";
+            const decoded = atob(match[2]);
+            imageBytes += decoded.length;
+            if (btoa(decoded) !== match[2] || imageBytes > 20 * 1024 * 1024)
+                return "invalid_request";
+        }
+        return null;
+    }
+    catch {
+        return "invalid_request";
+    }
+}
+export function restrictedCodexUsage(raw) {
+    const total = codexRecord(codexRecord(raw).total);
+    const input = total.inputTokens, output = total.outputTokens, cachedInput = total.cachedInputTokens, cacheWriteInput = total.cacheWriteInputTokens;
+    if (!count(input) ||
+        !count(output) ||
+        !count(cachedInput) ||
+        !count(cacheWriteInput) ||
+        cachedInput + cacheWriteInput > input)
+        return null;
+    return { input, output, cachedInput, cacheWriteInput };
+}
+export function restrictedCodexFailure(errorCode, dispatched = false, usage = null) {
+    return {
+        status: errorCode === "cancelled"
+            ? "cancelled"
+            : errorCode === "timeout"
+                ? "timed_out"
+                : errorCode === "refusal"
+                    ? "refused"
+                    : errorCode === "output_incomplete"
+                        ? "incomplete"
+                        : "failed",
+        output: null,
+        usage,
+        usageComplete: false,
+        dispatched,
+        errorCode,
+    };
+}
+/**
+ * The tool policy each app-server event must pass: raw items of an allowed type only, `exec` as
+ * the only custom tool, `wait` as the only function, and no agent message that delivers
+ * asynchronously or asks the user a question. True means the request stops with codex_tool_call.
+ */
+export function toolPolicyViolation(method, item, allowedRawItemTypes) {
+    if (method === "rawResponseItem/completed")
+        return (!allowedRawItemTypes.includes(String(item.type)) ||
+            (item.type === "custom_tool_call" && item.name !== "exec") ||
+            (item.type === "function_call" && item.name !== "wait"));
+    if (method === "item/started" || method === "item/completed")
+        return (item.type === "agentMessage" &&
+            (item.delivery === "async" || (Array.isArray(item.questions) && item.questions.length > 0)));
+    return false;
+}

package/dist/actors/codex/restricted-session.d.ts

@@ -0,0 +1,65 @@
+import type { ReasoningEffort } from "../reasoning-effort.js";
+import { type RestrictedCodexAnalysisErrorCode, type RestrictedCodexRequest, type RestrictedCodexResult, type RestrictedCodexUsage } from "./restricted-policy.js";
+import { type RestrictedCodexSpawn } from "./restricted-transport.js";
+/** Internal host dependencies. None of these options is accepted from a study artifact. */
+export interface RestrictedCodexSessionOptions {
+    executable?: string;
+    authHome?: string;
+    env?: NodeJS.ProcessEnv;
+    tempRoot?: string;
+    platform?: NodeJS.Platform;
+    arch?: string;
+    /** The release a caller already recorded (an analysis identity); any other release is refused. */
+    cliVersion?: string;
+    /**
+     * Bypasses qualification: replaces this host's admitted releases with any list. It exists only
+     * so scripts/codex-qualify.mjs can launch an unqualified candidate. No library export, lab
+     * manifest, CLI flag, RunLabOptions field or cuaHooks entry reaches it
+     * (tests/actors/codex/cli-versions-seam.test.ts).
+     */
+    cliVersions?: readonly string[];
+    spawnFn?: RestrictedCodexSpawn;
+    participant?: {
+        authMode?: "operator";
+        reasoningEffort?: ReasoningEffort;
+        tool: {
+            name: string;
+            description: string;
+            inputSchema: Record<string, unknown>;
+            call(args: unknown): Promise<string>;
+        };
+    };
+}
+/** Analysts/readiness keep their one-shot lifetime; participants own a session. */
+export declare function runRestrictedCodexSession(request: RestrictedCodexRequest, options?: RestrictedCodexSessionOptions, readinessOnly?: boolean): Promise<RestrictedCodexResult>;
+/** One private process and conversation per owner. Only completed turns may continue. */
+export interface RestrictedCodexSession {
+    readonly pendingUsage?: RestrictedCodexUsage | undefined;
+    readonly pendingInferenceUsage?: RestrictedCodexUsage[] | undefined;
+    readonly resolvedModel?: string | undefined;
+    readonly authentication?: "chatgpt-account" | "api-key" | undefined;
+    /** The admitted release this session launched, once its version check has passed. */
+    readonly cliVersion?: string | undefined;
+    run(request: RestrictedCodexRequest, readinessOnly?: boolean): Promise<RestrictedCodexResult>;
+    close(): Promise<boolean>;
+}
+export declare function createRestrictedCodexSession(options?: RestrictedCodexSessionOptions): RestrictedCodexSession;
+export declare function checkRestrictedCodexSessionReadiness(input?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}, options?: RestrictedCodexSessionOptions): Promise<RestrictedCodexResult>;
+/** Resolve and version-check the CLI an analyst launch would use, without app-server or a model.
+ * `--version` runs with a private temporary home, removed afterwards. */
+export declare function detectRestrictedCodexCliVersion(input?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}, options?: RestrictedCodexSessionOptions): Promise<{
+    cliVersion: string;
+    errorCode: null;
+    detectedVersion?: never;
+} | {
+    cliVersion: null;
+    errorCode: RestrictedCodexAnalysisErrorCode;
+    /** The release an unadmitted CLI reported, when it reported one. */
+    detectedVersion?: string;
+}>;