overlord-cli 0.2608271506.0 → 0.2608301049.0

package/dist/connectors/adapters/codex/README.md

@@ -29,7 +29,7 @@ From an OpenOverlord checkout:
 ovld agent-setup codex
 ```
 
-This copies managed plugin files to `~/.codex/plugins/overlord`, merges protocol permission rules into `~/.codex/rules/default.rules`, writes the personal marketplace entry at `~/.agents/plugins/marketplace.json`, and runs `codex plugin add overlord@overlord-local` when the Codex CLI is available.
+This copies managed plugin files to `~/.codex/plugins/overlord`, merges protocol permission rules into `~/.codex/rules/default.rules`, asks before merging the Overlord workspace permission profile into `~/.codex/config.toml`, writes the personal marketplace entry at `~/.agents/plugins/marketplace.json`, and runs `codex plugin add overlord@overlord-local` when the Codex CLI is available. The profile makes `overlord` the default, disables the JS REPL, enables Codex's network proxy, and permits network access only to `**.ovld.ai`.
 
 Re-run safely any time the connector contract version changes:
 

package/dist/connectors/docs/05-connectors-and-agent-plugins.md

@@ -97,6 +97,7 @@ Requirements:
   code changes.
 - Include permission hook to record tool permission requests.
 - Install protocol permission rules for `ovld protocol`.
+- During interactive Codex setup, ask `Configure Codex permissions to allow it to communicate with the Overlord server?` (default yes). On acceptance, merge the `overlord` workspace permission profile into `~/.codex/config.toml`: make it the default permission profile, disable `js_repl`, enable the network proxy, and allow only `**.ovld.ai` network access for that profile. Non-interactive `ovld agent-setup codex` applies the same idempotent merge so scripted setup remains usable.
 - Avoid generating or relying on a repository-local `AGENTS.md` for Overlord itself.
 - Detect or receive Codex native session/thread IDs when possible.
 - Launch with model and reasoning effort mapping:

package/dist/index.js

@@ -2420,6 +2420,7 @@ __export(connectors_exports, {
   expandInstallPath: () => expandInstallPath,
   inspectConnector: () => inspectConnector,
   listAvailableConnectors: () => listAvailableConnectors,
+  mergeCodexConfig: () => mergeCodexConfig,
   parseConnectorManifestYaml: () => parseConnectorManifestYaml,
   readConnectorManifest: () => readConnectorManifest,
   resolveHome: () => resolveHome,
@@ -2442,6 +2443,80 @@ import {
 import os2 from "node:os";
 import path6 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function setTomlScalar({
+  content,
+  section,
+  key,
+  value
+}) {
+  const assignment = `${key} = ${value}`;
+  const keyPattern = new RegExp(`^([ \\t]*)${escapeRegExp(key)}[ \\t]*=.*$`, "m");
+  if (!section) {
+    const firstSection = content.search(/^[ \t]*\[/m);
+    const prefix = firstSection === -1 ? content : content.slice(0, firstSection);
+    const suffix = firstSection === -1 ? "" : content.slice(firstSection);
+    if (keyPattern.test(prefix)) return content.replace(keyPattern, assignment);
+    return `${assignment}
+${prefix ? `
+${prefix.replace(/^\n+/, "")}` : ""}${suffix}`;
+  }
+  const header = new RegExp(`^[ \\t]*\\[${escapeRegExp(section)}\\][ \\t]*(?:#.*)?$`, "m");
+  const match = header.exec(content);
+  if (!match || match.index === void 0) {
+    const separator = content.trimEnd() ? "\n\n" : "";
+    return `${content.trimEnd()}${separator}[${section}]
+${assignment}
+`;
+  }
+  const sectionStart = match.index;
+  const bodyStart = sectionStart + match[0].length;
+  const nextSectionOffset = content.slice(bodyStart).search(/^[ \t]*\[/m);
+  const sectionEnd = nextSectionOffset === -1 ? content.length : bodyStart + nextSectionOffset;
+  const body = content.slice(bodyStart, sectionEnd);
+  if (keyPattern.test(body)) {
+    return `${content.slice(0, bodyStart)}${body.replace(keyPattern, assignment)}${content.slice(sectionEnd)}`;
+  }
+  const normalizedBody = body.endsWith("\n") ? body : `${body}
+`;
+  return `${content.slice(0, bodyStart)}${normalizedBody}${assignment}
+${content.slice(sectionEnd)}`;
+}
+function mergeCodexConfig(existingContent) {
+  let content = setTomlScalar({
+    content: existingContent,
+    key: "default_permissions",
+    value: '"overlord"'
+  });
+  content = setTomlScalar({ content, section: "features", key: "js_repl", value: "false" });
+  content = setTomlScalar({ content, section: "features", key: "network_proxy", value: "true" });
+  content = setTomlScalar({
+    content,
+    section: "permissions.overlord",
+    key: "description",
+    value: '"Workspace access with ovld.ai network access."'
+  });
+  content = setTomlScalar({
+    content,
+    section: "permissions.overlord",
+    key: "extends",
+    value: '":workspace"'
+  });
+  content = setTomlScalar({
+    content,
+    section: "permissions.overlord.network",
+    key: "enabled",
+    value: "true"
+  });
+  return setTomlScalar({
+    content,
+    section: "permissions.overlord.network.domains",
+    key: '"**.ovld.ai"',
+    value: '"allow"'
+  });
+}
 function connectorsRoot() {
   const override = process.env.OVERLORD_CONNECTORS_DIR;
   if (override) return override;
@@ -2715,11 +2790,13 @@ ${managedBlock}
 function configureCodexHarness({
   home,
   installPath,
+  configurePermissions = true,
   dryRun = false
 }) {
   const warnings = [];
   const marketplacePath = path6.join(home, ".agents", "plugins", "marketplace.json");
   const rulesPath = path6.join(home, ".codex", "rules", "default.rules");
+  const configPath = path6.join(home, ".codex", "config.toml");
   const legacyAgentsPath = path6.join(home, ".codex", "AGENTS.md");
   const hooksPath = path6.join(installPath, ".codex-plugin", "hooks.json");
   const currentMarketplace = readJsonObject(marketplacePath) ?? {
@@ -2742,6 +2819,9 @@ function configureCodexHarness({
   if (dryRun) {
     warnings.push(`Would update Codex marketplace at ${marketplacePath}.`);
     warnings.push(`Would merge protocol permission rules into ${rulesPath}.`);
+    if (configurePermissions) {
+      warnings.push(`Would configure Overlord permissions in ${configPath}.`);
+    }
     if (existsSync6(legacyAgentsPath)) {
       warnings.push(`Would remove legacy Codex bundle at ${legacyAgentsPath}.`);
     }
@@ -2769,6 +2849,10 @@ function configureCodexHarness({
   const existingRules = existsSync6(rulesPath) ? readFileSync6(rulesPath, "utf8") : "";
   mkdirSync3(path6.dirname(rulesPath), { recursive: true });
   writeFileSync3(rulesPath, mergeCodexRules(existingRules));
+  if (configurePermissions) {
+    const existingConfig = existsSync6(configPath) ? readFileSync6(configPath, "utf8") : "";
+    writeFileSync3(configPath, mergeCodexConfig(existingConfig));
+  }
   if (!readJsonObject(hooksPath)) {
     warnings.push(`Codex hook manifest missing or invalid at ${hooksPath}.`);
   }
@@ -2867,6 +2951,7 @@ function configureClaudeHarness({
 function setupConnector({
   agentKey,
   home,
+  configureCodexPermissions = true,
   dryRun = false
 }) {
   const manifest = readConnectorManifest(agentKey);
@@ -2951,7 +3036,14 @@ function setupConnector({
     warnings.push(...configureCursorHarness({ home: resolvedHome, dryRun }));
   }
   if (agentKey === "codex") {
-    warnings.push(...configureCodexHarness({ home: resolvedHome, installPath, dryRun }));
+    warnings.push(
+      ...configureCodexHarness({
+        home: resolvedHome,
+        installPath,
+        configurePermissions: configureCodexPermissions,
+        dryRun
+      })
+    );
   }
   if (agentKey === "claude") {
     warnings.push(...configureClaudeHarness({ home: resolvedHome, installPath, dryRun }));
@@ -2989,13 +3081,16 @@ function setupConnector({
 }
 function setupAllConnectors({
   home,
+  configureCodexPermissions = true,
   dryRun = false
 }) {
   const agents = listAvailableConnectors();
   if (agents.length === 0) {
     throw new CliError({ message: "No connector adapters found under connectors/adapters." });
   }
-  return agents.map((agentKey) => setupConnector({ agentKey, home, dryRun }));
+  return agents.map(
+    (agentKey) => setupConnector({ agentKey, home, configureCodexPermissions, dryRun })
+  );
 }
 function readInstallState(agentKey, home) {
   const statePath = installStatePath(agentKey, home);
@@ -3653,7 +3748,14 @@ async function configureAgentsForSetup() {
     defaultValue: "all"
   });
   const selected = parseAgentSelection(answer);
-  const results = selected.map((agentKey) => setupConnector({ agentKey }));
+  const results = [];
+  for (const agentKey of selected) {
+    const configureCodexPermissions = agentKey !== "codex" || await promptYesNo(
+      "Configure Codex permissions to allow it to communicate with the Overlord server?",
+      true
+    );
+    results.push(setupConnector({ agentKey, configureCodexPermissions }));
+  }
   for (const result of results) {
     printHumanResult(result);
   }
@@ -3922,6 +4024,13 @@ async function runAgentSetupCommand({
   const target = parsed.positional[0];
   const dryRun = flagBoolean(parsed.flags, "--dry-run");
   const home = flagValue(parsed.flags, "--home");
+  const shouldConfigureCodexPermissions = async (agentKey) => {
+    if (agentKey !== "codex" || dryRun || json2 || !process.stdin.isTTY) return true;
+    return promptYesNo(
+      "Configure Codex permissions to allow it to communicate with the Overlord server?",
+      true
+    );
+  };
   if (!target) {
     const available = listAvailableConnectors();
     if (json2) {
@@ -3936,7 +4045,18 @@ async function runAgentSetupCommand({
     }
     return;
   }
-  const results = target === "all" ? setupAllConnectors({ home, dryRun }) : [setupConnector({ agentKey: target, home, dryRun })];
+  const results = target === "all" ? setupAllConnectors({
+    home,
+    dryRun,
+    configureCodexPermissions: await shouldConfigureCodexPermissions("codex")
+  }) : [
+    setupConnector({
+      agentKey: target,
+      home,
+      dryRun,
+      configureCodexPermissions: await shouldConfigureCodexPermissions(target)
+    })
+  ];
   if (json2) {
     printJson({ ok: true, dryRun, results });
   } else {