viber-channel 0.8.1 → 0.8.2

package/lib/control_stream.ts

@@ -297,6 +297,12 @@ export function runPersistentControlStream(
   };
 
   const done = (async () => {
+    // #389 step-02: announce ONCE that the instance control stream actually
+    // connected server-side (the SSE `connected` open-marker arrived) — proof
+    // the agent is ONLINE/reachable, not merely registered. vibe-master's spawn
+    // readiness gate polls the bridge log for this line, so a launch that
+    // registers then fails to connect (CF/401/network) is NOT reported as ready.
+    let announcedOnline = false;
     try {
       while (true) {
         if (signal?.aborted) {
@@ -305,6 +311,13 @@ export function runPersistentControlStream(
         }
         try {
           for await (const ev of subscribeControlStream(opts)) {
+            if (ev.event === "connected") {
+              if (!announcedOnline) {
+                announcedOnline = true;
+                log("[control-stream] online — instance control stream connected\n");
+              }
+              continue;
+            }
             if (ev.event === "stop") {
               settleFirstReject(new ControlStreamStopped());
               handlers.onStop?.("stopped");
@@ -314,7 +327,7 @@ export function runPersistentControlStream(
               handlers.onBeatNow?.();
               continue;
             }
-            if (ev.event !== "join") continue; // connected / ping / unknown
+            if (ev.event !== "join") continue; // ping / unknown (connected handled above)
             const minted = parseJoinPayload(ev.data, log);
             if (!minted) continue;
             handlers.onJoin?.(minted);

package/package.json

@@ -1,46 +1,46 @@
-{
-  "name": "viber-channel",
-  "version": "0.8.1",
-  "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
-  "type": "module",
-  "bin": {
-    "viber-channel": "./viber-channel.ts",
-    "viber-codex-bridge": "./viber-codex-bridge.ts",
-    "viber-gemma-bridge": "./viber-gemma-bridge.ts",
-    "viber-codex-supervisor": "./viber-codex-supervisor.ts"
-  },
-  "files": [
-    "viber-channel.ts",
-    "viber-codex-bridge.ts",
-    "viber-gemma-bridge.ts",
-    "viber-codex-supervisor.ts",
-    "lib/",
-    "README.md"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/dgx80/viber.git",
-    "directory": "viber-channel"
-  },
-  "homepage": "https://viber.dgypx.dev",
-  "bugs": {
-    "url": "https://github.com/dgx80/viber/issues"
-  },
-  "keywords": [
-    "viber",
-    "claude-code",
-    "mcp",
-    "channel",
-    "voice",
-    "transcription"
-  ],
-  "license": "MIT",
-  "scripts": {
-    "start": "bun run viber-channel.ts",
-    "start:codex-bridge": "bun run viber-codex-bridge.ts",
-    "test": "bun test"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
-  }
-}
+{
+  "name": "viber-channel",
+  "version": "0.8.2",
+  "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
+  "type": "module",
+  "bin": {
+    "viber-channel": "./viber-channel.ts",
+    "viber-codex-bridge": "./viber-codex-bridge.ts",
+    "viber-gemma-bridge": "./viber-gemma-bridge.ts",
+    "viber-codex-supervisor": "./viber-codex-supervisor.ts"
+  },
+  "files": [
+    "viber-channel.ts",
+    "viber-codex-bridge.ts",
+    "viber-gemma-bridge.ts",
+    "viber-codex-supervisor.ts",
+    "lib/",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dgx80/viber.git",
+    "directory": "viber-channel"
+  },
+  "homepage": "https://viber.dgypx.dev",
+  "bugs": {
+    "url": "https://github.com/dgx80/viber/issues"
+  },
+  "keywords": [
+    "viber",
+    "claude-code",
+    "mcp",
+    "channel",
+    "voice",
+    "transcription"
+  ],
+  "license": "MIT",
+  "scripts": {
+    "start": "bun run viber-channel.ts",
+    "start:codex-bridge": "bun run viber-codex-bridge.ts",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  }
+}

package/viber-codex-bridge.ts

@@ -356,7 +356,7 @@ function instructionsForTier(tier: AgentTier): string {
     return [
       "You are a bridge-owned Codex agent connected to Viber, in READ-WRITE mode.",
       "You MAY read files, create/modify files within the workspace, and run commands (including state-changing ones) to carry out the user's requests.",
-      "The sandbox is workspace-write: writes are confined to the workspace and network access is blocked at the OS level.",
+      "The sandbox is workspace-write: writes are confined to the workspace, and network access is ENABLED — so you can run git (including `git push`) and open pull requests (e.g. with `gh`).",
       "There is NO human approval step, so be deliberate: make only the changes the user asked for, and avoid destructive commands unless explicitly requested.",
       VOICE_CONCISE_LINE,
       CHANNEL_TOOLS_LINE,
@@ -385,17 +385,43 @@ function instructionsForTier(tier: AgentTier): string {
 // Approval policy per tier. `read`/`write` use "never" so Codex runs its commands
 // WITHOUT a human approver (there is none on the bridge) — the SANDBOX is the real
 // guardrail (read-only blocks writes/network; workspace-write confines writes to
-// the workspace and still blocks network). `chat` keeps "on-request" (no exec anyway).
-function approvalForTier(tier: AgentTier): "never" | "on-request" {
+// the workspace). `chat` keeps "on-request" (no exec anyway).
+export function approvalForTier(tier: AgentTier): "never" | "on-request" {
   return tier === "chat" ? "on-request" : "never";
 }
 
 // Codex OS sandbox per tier. `write` widens to workspace-write (edits confined to
-// the workspace, network still blocked); chat/read stay read-only.
-function sandboxForTier(tier: AgentTier): "read-only" | "workspace-write" {
+// the workspace); chat/read stay read-only.
+export function sandboxForTier(tier: AgentTier): "read-only" | "workspace-write" {
   return tier === "write" ? "workspace-write" : "read-only";
 }
 
+// Network access per tier (#389 step-03). ONLY the trusted `write` tier gets
+// network — so a codex coder can `git push` and open its PR (git-over-https +
+// `gh`). read/chat stay offline. SECURITY: codex's workspace-write sandbox opens
+// ALL network, not git-only (the app-server sandbox has no per-domain allowlist),
+// so this is a TRUST decision scoped to the write tier, which is already
+// operator-authorized-at-launch for unattended command execution. If codex ever
+// exposes an outbound-domain allowlist, tighten here (follow-up issue).
+export function networkForTier(tier: AgentTier): boolean {
+  return tier === "write";
+}
+
+// The EXACT `sandboxPolicy` object sent on every `turn/start` (#389 step-03).
+// Per the codex app-server protocol (generate-ts), `networkAccess` lives ONLY on
+// this per-turn policy object (workspaceWrite/readOnly variants) — NOT on
+// thread/start|resume, which take a bare `sandbox` MODE string. So the turn-level
+// policy is the single lever for network. Exported to unit-test the payload/tier.
+export function buildTurnSandboxPolicy(
+  tier: AgentTier,
+):
+  | { type: "workspaceWrite"; networkAccess: boolean }
+  | { type: "readOnly"; networkAccess: boolean } {
+  return sandboxForTier(tier) === "workspace-write"
+    ? { type: "workspaceWrite", networkAccess: networkForTier(tier) }
+    : { type: "readOnly", networkAccess: false };
+}
+
 const AGENT_TIER: AgentTier = resolveAgentTier();
 // Identity line (#309 step-17) is appended AFTER the tier instructions so the
 // permission rules stay first + strongest; the role is framed as descriptive and
@@ -635,10 +661,7 @@ class CodexAppServer {
       cwd: process.cwd(),
       runtimeWorkspaceRoots: [process.cwd()],
       approvalPolicy: AGENT_APPROVAL_POLICY,
-      sandboxPolicy:
-        AGENT_SANDBOX === "workspace-write"
-          ? { type: "workspaceWrite", networkAccess: false }
-          : { type: "readOnly", networkAccess: false },
+      sandboxPolicy: buildTurnSandboxPolicy(AGENT_TIER),
       developerInstructions: AGENT_INSTRUCTIONS,
       responsesapiClientMetadata: { source: "viber-codex-bridge" },
     });
@@ -1115,7 +1138,7 @@ function setupCodexRuntime(deps: {
 
 function logCodexSafety(): void {
   process.stderr.write(
-    `${LOG_PREFIX} codex safety: tier=${AGENT_TIER}, sandbox=${AGENT_SANDBOX}, approvalPolicy=${AGENT_APPROVAL_POLICY}, network=false, ` +
+    `${LOG_PREFIX} codex safety: tier=${AGENT_TIER}, sandbox=${AGENT_SANDBOX}, approvalPolicy=${AGENT_APPROVAL_POLICY}, network=${networkForTier(AGENT_TIER)}, ` +
       `instructions=${
         AGENT_TIER === "write"
           ? "read+write/run commands (workspace)"