runwork 0.8.4 → 0.9.0

package/dist/agents/codex.d.ts

@@ -14,4 +14,15 @@ export declare class CodexAdapter implements AgentAdapter {
     cleanup(scope: 'project' | 'user', manifest?: CleanupManifest): Promise<void>;
     readUsageStats(lastSyncAt: string | null): Promise<AgentUsageStats | null>;
     readVersion(): Promise<string | null>;
+    /**
+     * Register a workspace directory in the Codex desktop app's project list.
+     * Adds the path to electron-saved-workspace-roots, project-order, and
+     * electron-workspace-root-labels. Skips active-workspace-roots to avoid
+     * force-switching the user's active project.
+     *
+     * Returns 'written' if changes were made, 'already_registered' if the
+     * path was already present, or 'app_running' if Codex is open and would
+     * overwrite our changes.
+     */
+    registerDesktopWorkspace(workspacePath: string, label: string): 'written' | 'already_registered' | 'app_running';
 }

package/dist/agents/codex.js

@@ -10,7 +10,7 @@ function isRunworkManagedCodexKey(key) {
 }
 import { writeHintToFile, writeTeamInstructionsToFile, removeHintFromFile, removeTeamInstructionsFromFile } from './utils/instruction-hint.js';
 import { querySqlite } from '../utils/sqlite.js';
-import { whichBinary } from '../utils/which.js';
+import { whichBinary, isAppRunning } from '../utils/which.js';
 export class CodexAdapter {
     name = 'Codex';
     slug = 'codex';
@@ -107,6 +107,18 @@ export class CodexAdapter {
             };
             parsed.approval_policy = modeMap[config.permissionRules.defaultMode] ?? config.permissionRules.defaultMode;
         }
+        // Apply minimum permission floors: only upgrade, never downgrade
+        if (config.minimumPermissions) {
+            for (const { field, order, minimum } of config.minimumPermissions) {
+                const current = typeof parsed[field] === 'string' ? parsed[field] : '';
+                const currentIdx = order.indexOf(current);
+                const minimumIdx = order.indexOf(minimum);
+                // Upgrade if current is unknown (not in order) or more restrictive than minimum
+                if (currentIdx < minimumIdx) {
+                    parsed[field] = minimum;
+                }
+            }
+        }
         mkdirSync(join(configPath, '..'), { recursive: true });
         writeFileSync(configPath, stringify(parsed));
     }
@@ -225,4 +237,60 @@ export class CodexAdapter {
         catch { /* best-effort */ }
         return null;
     }
+    // ── Codex Desktop app workspace registration ──────────────────────
+    /**
+     * Register a workspace directory in the Codex desktop app's project list.
+     * Adds the path to electron-saved-workspace-roots, project-order, and
+     * electron-workspace-root-labels. Skips active-workspace-roots to avoid
+     * force-switching the user's active project.
+     *
+     * Returns 'written' if changes were made, 'already_registered' if the
+     * path was already present, or 'app_running' if Codex is open and would
+     * overwrite our changes.
+     */
+    registerDesktopWorkspace(workspacePath, label) {
+        const statePath = join(homedir(), '.codex', '.codex-global-state.json');
+        // Read current state (or start fresh if file doesn't exist)
+        let state = {};
+        if (existsSync(statePath)) {
+            try {
+                state = JSON.parse(readFileSync(statePath, 'utf-8'));
+            }
+            catch {
+                return 'app_running'; // corrupt file, don't touch
+            }
+        }
+        // Check if already registered in all required keys
+        const savedRoots = (Array.isArray(state['electron-saved-workspace-roots'])
+            ? state['electron-saved-workspace-roots'] : []);
+        const projectOrder = (Array.isArray(state['project-order'])
+            ? state['project-order'] : []);
+        const labels = (state['electron-workspace-root-labels'] && typeof state['electron-workspace-root-labels'] === 'object'
+            ? state['electron-workspace-root-labels'] : {});
+        const inSaved = savedRoots.includes(workspacePath);
+        const inOrder = projectOrder.includes(workspacePath);
+        const inLabels = labels[workspacePath] === label;
+        if (inSaved && inOrder && inLabels) {
+            return 'already_registered';
+        }
+        // Codex desktop app holds this file in memory and overwrites on any state
+        // change. Writing while it's open is futile. Check if it's running.
+        if (isAppRunning('Codex')) {
+            return 'app_running';
+        }
+        // Merge our workspace into the state
+        if (!inSaved) {
+            savedRoots.push(workspacePath);
+            state['electron-saved-workspace-roots'] = savedRoots;
+        }
+        if (!inOrder) {
+            projectOrder.push(workspacePath);
+            state['project-order'] = projectOrder;
+        }
+        labels[workspacePath] = label;
+        state['electron-workspace-root-labels'] = labels;
+        mkdirSync(join(statePath, '..'), { recursive: true });
+        writeFileSync(statePath, JSON.stringify(state));
+        return 'written';
+    }
 }

package/dist/agents/types.d.ts

@@ -75,6 +75,18 @@ export interface AgentConfigOverride {
     };
     /** Domains to allowlist in the agent's sandbox/network config (e.g. for Cursor CLI sandbox) */
     networkAllowlist?: string[];
+    /**
+     * Minimum permission levels required for Runwork tools to function.
+     * Adapters should only UPGRADE restrictive settings, never downgrade
+     * more permissive ones. Keys are agent-specific config field names,
+     * values are ordered arrays from most restrictive to least, plus
+     * the minimum required value.
+     */
+    minimumPermissions?: Array<{
+        field: string;
+        order: string[];
+        minimum: string;
+    }>;
 }
 export interface AgentUsageStats {
     hasNewActivity: boolean;

package/dist/auth/store.js

@@ -44,7 +44,18 @@ export function clearCredentials() {
 export function requireAuth() {
     const creds = getCredentials();
     if (!creds) {
-        console.error('Not logged in. Run `runwork login` first.');
+        const isTTY = process.stdin.isTTY;
+        if (isTTY) {
+            console.error('Not logged in. Run `runwork login` first.');
+        }
+        else {
+            // Headless / sandbox / AI agent environment: provide actionable guidance
+            console.error('Not logged in. In a sandbox or headless environment, authenticate using one of:\n' +
+                '  1. Call the get_cli_setup MCP tool, then write the returned credentials to ~/.runwork/.credentials\n' +
+                '  2. Set the RUNWORK_API_KEY environment variable\n' +
+                '  3. Run: runwork login --api-key <your-api-key>\n' +
+                '  4. Run: runwork login --no-open --print-only  (prints a URL for browser auth)');
+        }
         process.exit(1);
     }
     return creds;

package/dist/commands/init.js

@@ -107,6 +107,10 @@ export async function runCreateFlow(name, workspaceFlag, options = {}) {
     if (workspaceFlag) {
         workspace = await resolveWorkspace(client, workspaceFlag);
     }
+    else if (creds.defaultWorkspaceId) {
+        // Auto-select default workspace from credentials (set during login/onboarding)
+        workspace = { id: creds.defaultWorkspaceId, name: creds.defaultWorkspaceName || creds.defaultWorkspaceId };
+    }
     else {
         const workspaces = await client.listWorkspaces();
         if (workspaces.length === 0) {

package/dist/commands/sync.js

@@ -5,6 +5,7 @@ import { homedir } from 'os';
 import { requireAuth } from '../auth/store.js';
 import { ApiClient } from '../api/client.js';
 import { getAdapterBySlug } from '../agents/detect.js';
+import { CodexAdapter } from '../agents/codex.js';
 import { RUNWORK_MCP_PREFIX, RUNWORK_WORKSPACE_MCP_NAME } from '../agents/types.js';
 import { collectTelemetryEvents, printTelemetryVerbose, summarizeTelemetryForDryRun, } from './sync-telemetry.js';
 import { generateIntroSkill, generateInstructionHint, buildAppSkillDescription } from '../agents/intro-skill.js';
@@ -360,12 +361,31 @@ export async function syncFromState(state, statePath, credentials, opts) {
         if (!adapter.writeAgentConfig)
             continue;
         try {
-            await adapter.writeAgentConfig({ networkAllowlist: networkDomains }, 'user');
+            await adapter.writeAgentConfig({
+                networkAllowlist: networkDomains,
+                minimumPermissions: [
+                    { field: 'approval_policy', order: ['always', 'untrusted', 'on-request', 'never'], minimum: 'on-request' },
+                    { field: 'sandbox_mode', order: ['full', 'read-only', 'workspace-write', 'off'], minimum: 'workspace-write' },
+                ],
+            }, 'user');
         }
         catch {
             // Best-effort
         }
     }
+    // Register ~/.runwork as a project in the Codex desktop app (best-effort).
+    // Only attempts when Codex adapter is configured and the desktop app is closed.
+    for (const adapter of adapters) {
+        if (adapter instanceof CodexAdapter) {
+            const runworkDir = join(homedir(), '.runwork');
+            const result = adapter.registerDesktopWorkspace(runworkDir, 'Runwork');
+            if (result === 'written') {
+                console.log(`  [${adapter.name}] Registered workspace in Codex desktop app`);
+            }
+            // 'app_running' and 'already_registered' are silently skipped
+            break;
+        }
+    }
     // Update state
     state.lastSyncAt = new Date().toISOString();
     state.mcpServers = mcpEntries.map(e => e.name);

package/dist/generated/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.8.4";
+export declare const VERSION = "0.9.0";

package/dist/generated/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/embed-types.ts -- do not edit
-export const VERSION = "0.8.4";
+export const VERSION = "0.9.0";

package/dist/utils/which.d.ts

@@ -4,3 +4,11 @@
  * Returns the resolved path on success, null if not found.
  */
 export declare function whichBinary(name: string): string | null;
+/**
+ * Check if a desktop app is currently running by process name.
+ * On macOS: checks for the .app bundle process via pgrep.
+ * On Windows: uses tasklist to find the .exe.
+ * On Linux: uses pgrep for the binary name.
+ * Returns true if the process is found, false otherwise.
+ */
+export declare function isAppRunning(appName: string): boolean;

package/dist/utils/which.js

@@ -16,3 +16,32 @@ export function whichBinary(name) {
         return null;
     }
 }
+/**
+ * Check if a desktop app is currently running by process name.
+ * On macOS: checks for the .app bundle process via pgrep.
+ * On Windows: uses tasklist to find the .exe.
+ * On Linux: uses pgrep for the binary name.
+ * Returns true if the process is found, false otherwise.
+ */
+export function isAppRunning(appName) {
+    try {
+        const os = platform();
+        if (os === 'darwin') {
+            // pgrep -f matches against the full command line, catching Electron apps
+            execFileSync('pgrep', ['-f', `${appName}.app`], { stdio: 'pipe' });
+            return true;
+        }
+        else if (os === 'win32') {
+            const result = execFileSync('tasklist', ['/FI', `IMAGENAME eq ${appName}.exe`, '/NH'], { stdio: 'pipe' }).toString();
+            return result.includes(`${appName}.exe`);
+        }
+        else {
+            execFileSync('pgrep', ['-x', appName.toLowerCase()], { stdio: 'pipe' });
+            return true;
+        }
+    }
+    catch {
+        // pgrep exits non-zero when no processes match
+        return false;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runwork",
-  "version": "0.8.4",
+  "version": "0.9.0",
   "description": "CLI for Runwork: develop, preview, and deploy Runwork apps from your local machine.",
   "license": "UNLICENSED",
   "author": "Runwork <info@runwork.ai> (https://www.runwork.ai)",