talentos 1.1.5 → 1.2.0

package/dist/agent/adapters.js

@@ -1,8 +1,7 @@
 import { execFile, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { rm } from "node:fs/promises";
+import { delimiter, dirname, join } from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
@@ -10,6 +9,9 @@ import { writePrivateFile } from "../agent-config.js";
 import { redactAgentOutput, } from "../agent-link.js";
 import { gatewayLauncherPath } from "../gateway-install.js";
 import { providerPathEnv, resolveProviderBinary } from "../provider-binary.js";
+import { codexRoomArgs, ROOM_TOOLS } from "./codex-policy.js";
+import { CodexBoundaryError, probeCodexBoundary } from "./codex-probe.js";
+import { prepareOwnerLaunch } from "./native/launch.js";
 const CHILD_ENV = [
     "HOME",
     "PATH",
@@ -26,26 +28,9 @@ const CHILD_ENV = [
     "CODEX_HOME",
     "CLAUDE_CONFIG_DIR",
 ];
-// Shared with the preflight: older Codex parses agents.enabled as a role.
-const CODEX_ROOM_GATES = ["agents.enabled=false", "features.goals=false"];
 const CLAUDE_VERSION = /^\d+\.\d+\.\d+/u;
 const CODEX_VERSION = /\b\d+\.\d+\.\d+\b/u;
 const DONT_ASK = /\bdontAsk\b/u;
-// Kept package-local for the published CLI. The launch tests compare both
-// adapters against the server's exported ROOM_AGENT_TOOLS contract.
-const ROOM_TOOLS = [
-    "list_rooms",
-    "read_room",
-    "list_room_files",
-    "read_file",
-    "get_skill",
-    "suggest_change",
-    "create_file",
-    "create_deck",
-    "post_message",
-    "share_link",
-    "whoami",
-];
 const CLAUDE_TOOLS = ROOM_TOOLS.map((tool) => `mcp__talentos__${tool}`).join(",");
 export function childEnvironment(source = process.env, binary) {
     return {
@@ -78,12 +63,13 @@ export async function verifyClaudeCode(configured) {
     }
     throw new Error(`Update Claude Code (${version}) to a version that supports --permission-mode dontAsk.`);
 }
-export async function verifyCodex(configured) {
+export async function verifyCodex(configured, signal) {
     const binary = resolveProviderBinary("codex", configured);
     const execute = promisify(execFile);
     const options = {
         env: childEnvironment(process.env, binary),
         timeout: 5000,
+        signal,
         maxBuffer: 256_000,
     };
     let version = "unknown";
@@ -105,26 +91,14 @@ export async function verifyCodex(configured) {
             }
         }
         if (version !== "unknown") {
-            await codexRoomCatalog(binary);
-            const directory = await mkdtemp(join(tmpdir(), "talentos-codex-probe-"));
-            try {
-                await execute(binary, [
-                    ...CODEX_ROOM_GATES.flatMap((gate) => ["-c", gate]),
-                    "features",
-                    "list",
-                ], {
-                    ...options,
-                    cwd: directory,
-                    env: { ...options.env, CODEX_HOME: directory },
-                });
-            }
-            finally {
-                await rm(directory, { recursive: true, force: true });
-            }
+            await probeCodexBoundary(binary, version, await codexRoomCatalog(binary), signal);
             return;
         }
     }
-    catch {
+    catch (error) {
+        if (error instanceof CodexBoundaryError) {
+            throw error;
+        }
         // Provider diagnostics can contain login details.
     }
     throw new Error(`Update Codex (${version}) to a version supporting isolated room turns, exec/resume flags and a local model catalog.`);
@@ -157,6 +131,7 @@ async function codexRoomCatalog(binary) {
                 // Code-mode-only models route MCP through native execution. Expose
                 // allowed MCP functions directly while native execution stays off.
                 tool_mode: "direct",
+                supports_search_tool: false,
             };
         });
         return JSON.stringify({ ...catalog, models });
@@ -216,7 +191,26 @@ export async function runProvider(input) {
     const catalogPath = join(dirname(workDir), ".talentos-codex-models.json");
     const binary = resolveProviderBinary(config.provider, config.providerPath);
     let command, args;
-    if (config.provider === "claude_code") {
+    let ownerLaunch;
+    let stopWatching;
+    if (input.owner && config.provider === "claude_code") {
+        const watching = await input.owner.watch?.();
+        stopWatching = watching?.stop;
+        ownerLaunch = await prepareOwnerLaunch({
+            agentId: config.agentId,
+            askSocket: watching?.socketPath,
+            directory: dirname(workDir),
+            home: input.owner.home,
+            instructions,
+            jobId: job.jobId,
+            prompt,
+            sessionId,
+            workspace: input.owner.workspace,
+        });
+        command = binary;
+        args = ownerLaunch.args;
+    }
+    else if (config.provider === "claude_code") {
         await writePrivateFile(mcpPath, JSON.stringify({
             mcpServers: {
                 talentos: {
@@ -258,56 +252,43 @@ export async function runProvider(input) {
         await writePrivateFile(catalogPath, await codexRoomCatalog(binary));
         // Resume has a different flag surface. Root overrides are inherited by
         // both exec paths; shell_tool=false enforces ADR 0093's default no-Bash.
-        args = [
-            "-c",
-            'sandbox_mode="read-only"',
-            "-c",
-            'approval_policy="never"',
-            "-c",
-            "features.shell_tool=false",
-            "-c",
-            "features.unified_exec=false",
-            "-c",
-            'web_search="disabled"',
-            "-c",
-            "features.view_image=false",
-            "-c",
-            "features.image_generation=false",
-            "-c",
-            "features.apps=false",
-            "-c",
-            "features.plugins=false",
-            "-c",
-            "features.multi_agent=false",
-            // Codex also gates collaboration separately from the legacy feature.
-            ...CODEX_ROOM_GATES.flatMap((gate) => ["-c", gate]),
-            "-c",
-            "features.skip_host_skill_discovery=true",
-            "-c",
-            "memories.use_memories=false",
-            "-c",
-            "memories.generate_memories=false",
-            "-c",
-            `model_catalog_json=${JSON.stringify(catalogPath)}`,
-            "-c",
-            `mcp_servers.talentos.enabled_tools=${JSON.stringify(ROOM_TOOLS)}`,
-            "-c",
-            `mcp_servers.talentos.command=${JSON.stringify(useLauncher ? launcher : process.execPath)}`,
-            "-c",
-            `mcp_servers.talentos.args=${JSON.stringify([...(useLauncher ? [] : [fileURLToPath(new URL("../index.js", import.meta.url))]), "agent", "mcp", "--agent", config.agentId])}`,
-            "exec",
-        ];
-        if (sessionId) {
-            args.push("resume", sessionId);
-        }
-        args.push("--json", "--skip-git-repo-check", "--ignore-user-config", "--ignore-rules", prompt);
+        args = codexRoomArgs({
+            catalogPath,
+            mcpCommand: useLauncher ? launcher : process.execPath,
+            mcpArgs: [
+                ...(useLauncher
+                    ? []
+                    : [fileURLToPath(new URL("../index.js", import.meta.url))]),
+                "agent",
+                "mcp",
+                "--agent",
+                config.agentId,
+            ],
+            prompt,
+            sessionId,
+        });
     }
     const child = spawn(command, args, {
-        cwd: workDir,
-        env: childEnvironment(process.env, binary),
+        cwd: input.owner?.workspace.cwd ?? workDir,
+        env: input.owner
+            ? {
+                ...input.owner.env,
+                PATH: [dirname(binary), input.owner.env.PATH]
+                    .filter(Boolean)
+                    .join(delimiter),
+            }
+            : childEnvironment(process.env, binary),
         stdio: ["ignore", "pipe", "ignore"],
         detached: process.platform !== "win32",
     });
+    const marked = new Set();
+    const mark = (name) => {
+        if (!marked.has(name)) {
+            marked.add(name);
+            input.mark?.(name);
+        }
+    };
+    child.once("spawn", () => mark("spawn"));
     let killTimer;
     const stop = () => {
         const pid = child.pid;
@@ -356,6 +337,10 @@ export async function runProvider(input) {
                 continue;
             }
             const event = readProviderEvent(config.provider, value);
+            mark("firstEvent");
+            if (event.status) {
+                mark("firstTool");
+            }
             if (event.failed) {
                 failed = true;
             }
@@ -363,7 +348,8 @@ export async function runProvider(input) {
                 await input.remember(event.sessionId);
             }
             if (event.status) {
-                input.status(event.status);
+                // Room-visible status never names the owner's private tools.
+                input.status(ownerLaunch ? "Working on your computer…" : event.status);
             }
             if (event.text !== undefined) {
                 text = event.text.slice(0, 12_000);
@@ -388,5 +374,7 @@ export async function runProvider(input) {
         }
         await rm(mcpPath, { force: true });
         await rm(catalogPath, { force: true });
+        stopWatching?.();
+        await ownerLaunch?.cleanup();
     }
 }

package/dist/agent/codex-policy.js

@@ -0,0 +1,72 @@
+export const ROOM_TOOLS = [
+    "list_rooms",
+    "read_room",
+    "list_room_files",
+    "read_file",
+    "get_skill",
+    "suggest_change",
+    "create_file",
+    "create_deck",
+    "create_web_app",
+    "revise_web_app",
+    "upload_file",
+    "prepare_upload",
+    "commit_upload",
+    "post_message",
+    "share_link",
+    "whoami",
+];
+export function codexRoomArgs(input) {
+    const { catalogPath, mcpCommand, mcpArgs, prompt, sessionId } = input;
+    const args = [
+        "-c",
+        'sandbox_mode="read-only"',
+        "-c",
+        'approval_policy="never"',
+        "-c",
+        "features.shell_tool=false",
+        "-c",
+        "features.unified_exec=false",
+        "-c",
+        'web_search="disabled"',
+        "-c",
+        "features.view_image=false",
+        "-c",
+        "features.image_generation=false",
+        "-c",
+        "features.apps=false",
+        "-c",
+        "features.plugins=false",
+        "-c",
+        "features.multi_agent=false",
+        // Codex also gates collaboration separately from the legacy feature.
+        "-c",
+        "agents.enabled=false",
+        "-c",
+        "features.goals=false",
+        "-c",
+        "tools.experimental_request_user_input.enabled=false",
+        "-c",
+        "features.tool_search=false",
+        "-c",
+        "features.skip_host_skill_discovery=true",
+        "-c",
+        "memories.use_memories=false",
+        "-c",
+        "memories.generate_memories=false",
+        "-c",
+        `model_catalog_json=${JSON.stringify(catalogPath)}`,
+        "-c",
+        `mcp_servers.talentos.enabled_tools=${JSON.stringify(ROOM_TOOLS)}`,
+        "-c",
+        `mcp_servers.talentos.command=${JSON.stringify(mcpCommand)}`,
+        "-c",
+        `mcp_servers.talentos.args=${JSON.stringify(mcpArgs)}`,
+        "exec",
+    ];
+    if (sessionId) {
+        args.push("resume", sessionId);
+    }
+    args.push("--json", "--skip-git-repo-check", "--ignore-user-config", "--ignore-rules", prompt);
+    return args;
+}