viber-channel 0.8.10 → 0.8.11

package/lib/codex_shell_path.ts

@@ -0,0 +1,119 @@
+/**
+ * codex_shell_path — #500: let codex spawn processes on Windows again.
+ *
+ * codex's Windows sandbox launches every command under a RESTRICTED TOKEN
+ * (`CreateProcessAsUserW`). Windows refuses to start an MSIX-PACKAGED binary
+ * that way, and the shell codex resolves on JP's machine is PowerShell 7 from
+ * the Microsoft Store — packaged under `C:\Program Files\WindowsApps\…`. So
+ * every command died with:
+ *
+ *   windows sandbox: runner failed during SpawnChild:
+ *   CreateProcessAsUserW failed: 5 (Access is denied.)
+ *
+ * Measured, 20 trials per case (success = absence of `CreateProcessAsUserW`),
+ * reproduced independently by a second agent:
+ *
+ *   | target                                  | spawn failures |
+ *   | pwsh MSIX (package dir OR alias dir)    | 20/20          |
+ *   | powershell 5.1 / cmd.exe / git bash     |  0/20          |
+ *
+ * FIX: drop the `WindowsApps` directories from the PATH of the `codex
+ * app-server` CHILD ONLY. codex then resolves `powershell.exe` 5.1 and spawns
+ * fine (measured end to end: `hello_from_shell`, exit 0, 722 ms).
+ *
+ * REJECTED — `-c windows.sandbox="unelevated"`. It also fixes the spawn (0/20
+ * failures on the MSIX target), but it switches the sandbox to the legacy
+ * backend, and that has two measured costs:
+ *   - PowerShell drops to **ConstrainedLanguage** (5/5, both agents): .NET
+ *     method calls, `Add-Type` and type casts fail in agent scripts;
+ *   - codex's own binary states that "Restricted read-only access requires the
+ *     elevated Windows sandbox backend" — our `read`/`chat` tiers rely on the
+ *     read-only sandbox, so they would be SILENTLY weakened, and any future
+ *     deny-read path (`.viber/auth.json`, `~/.ssh`) would be a no-op.
+ * Writes outside the workspace stay blocked in both modes, so the tradeoff is
+ * not about writes — it is about keeping the backend our tiers are built on.
+ */
+
+/**
+ * A PATH entry that resolves to Store/MSIX app-execution aliases.
+ *
+ * Anchored on a whole path SEGMENT: a substring match would also strip
+ * `C:\SDK\WindowsAppsSDK\bin` and nobody would understand why six months later.
+ * The two real cases stay covered — the package dir and
+ * `%LOCALAPPDATA%\Microsoft\WindowsApps`.
+ */
+function isWindowsAppsEntry(entry: string): boolean {
+	return /[\\/]windowsapps([\\/]|$)/i.test(entry.replace(/[\\/]+$/, ""));
+}
+
+export interface SanitizeResult {
+	/** The PATH to hand the child. Unchanged when no surgery was needed. */
+	path: string;
+	/** Entries removed, in their original order. Empty when nothing changed. */
+	stripped: string[];
+	/** Set when surgery was NEEDED but deliberately skipped — worth logging. */
+	skipped?: string;
+}
+
+/**
+ * Remove the MSIX alias directories from a PATH — but only on Windows, and only
+ * when no unpackaged `pwsh.exe` is REACHABLE, i.e. sits on a surviving PATH
+ * entry. An MSI PowerShell 7 that exists on disk but is not on the PATH does
+ * NOT count: codex resolves its shell through the PATH, so it would still land
+ * on the broken packaged one (raised in review — we do not have a measurement
+ * showing codex probes fixed locations, so we must not assume it does).
+ *
+ * Pure: platform, PATH and filesystem probing are all injected, so this never
+ * depends on the machine running the test.
+ */
+export function sanitizeCodexPath(
+	pathValue: string | undefined,
+	opts: { platform: string; exists: (p: string) => boolean; sep?: string },
+): SanitizeResult {
+	const sep = opts.sep ?? ";";
+	const original = pathValue ?? "";
+	if (opts.platform !== "win32") return { path: original, stripped: [] };
+
+	const entries = original.split(sep);
+	const kept = entries.filter((e) => !isWindowsAppsEntry(e));
+	const stripped = entries.filter((e) => isWindowsAppsEntry(e) && e.trim() !== "");
+	if (stripped.length === 0) return { path: original, stripped: [] };
+
+	// An unpackaged pwsh on a surviving entry means codex already has a shell it
+	// can spawn — leave the PATH intact so the child keeps its Store aliases
+	// (python stub, wt, …).
+	const onKeptPath = (exe: string): boolean =>
+		kept.some((dir) => dir.trim() !== "" && opts.exists(`${dir.replace(/[\\/]+$/, "")}\\${exe}`));
+	if (onKeptPath("pwsh.exe")) return { path: original, stripped: [] };
+
+	// Floor: if not even cmd.exe survives the surgery, codex would have no shell
+	// to fall back on — stripping would cost the Store aliases for nothing.
+	// PowerShell 5.1 IS removable as an optional feature on recent Windows 11,
+	// so this is not purely theoretical. Do nothing, and say so.
+	if (!onKeptPath("cmd.exe") && !onKeptPath("powershell.exe")) {
+		return { path: original, stripped: [], skipped: "no unpackaged shell would remain on PATH" };
+	}
+
+	return { path: kept.join(sep), stripped };
+}
+
+/**
+ * Apply {@link sanitizeCodexPath} to a child environment, in place.
+ *
+ * Windows env keys are case-INSENSITIVE, a JS object's are not: a parent may
+ * carry `Path`, `PATH` or even `PaTh`, and handing the child two spellings of
+ * the same variable is asking for the wrong one to win. So we read whichever
+ * variant exists, then collapse them all into one canonical `PATH`.
+ */
+export function applySanitizedPath(
+	env: Record<string, string | undefined>,
+	opts: { platform: string; exists: (p: string) => boolean; sep?: string },
+): SanitizeResult {
+	const keys = Object.keys(env).filter((k) => k.toLowerCase() === "path");
+	const current = keys.map((k) => env[k]).find((v) => v !== undefined);
+	const result = sanitizeCodexPath(current, opts);
+	if (result.stripped.length === 0) return result;
+	for (const k of keys) delete env[k];
+	env.PATH = result.path;
+	return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.10",
+  "version": "0.8.11",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-codex-bridge.ts

@@ -12,6 +12,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { authFilePath, loadAuth } from "./lib/auth.ts";
 import { CONTRACT_STYLE_NEUTRAL, CONTRACT_STYLE_TOOLS } from "./lib/channel_instructions.ts";
+import { applySanitizedPath } from "./lib/codex_shell_path.ts";
 import {
   ConversationMintError,
   defaultLabel,
@@ -620,6 +621,32 @@ class CodexAppServer {
     const codexBin = process.env.VIBER_CODEX_BIN?.trim() || "codex";
     const args = ["app-server"];
     const childEnv = { ...process.env };
+    // #500: codex's Windows sandbox cannot spawn an MSIX-packaged shell (Store
+    // PowerShell 7) under a restricted token — every command died with
+    // CreateProcessAsUserW failed: 5. Drop the WindowsApps alias dirs from the
+    // CHILD's PATH so codex resolves powershell.exe 5.1 instead. The sandbox
+    // keeps its `elevated` backend, which our read-only tiers depend on.
+    // applySanitizedPath collapses every case-variant of the key into one
+    // canonical PATH — handing the child both `Path` and `PATH` would let the
+    // stale one win.
+    const sanitized = applySanitizedPath(childEnv, {
+      platform: process.platform,
+      exists: existsSync,
+    });
+    if (sanitized.stripped.length > 0) {
+      process.stderr.write(
+        `[viber-codex-bridge] #500: removed ${sanitized.stripped.length} MSIX alias dir(s) from the ` +
+          `codex child's PATH so it can spawn processes: ${sanitized.stripped.join(", ")}. ` +
+          "The child therefore loses the Store execution aliases — notably WINGET (and wt, ngrok, " +
+          "the WSL launchers); node/npm/bun/git/codex/python are unaffected. Installing PowerShell 7 " +
+          "from the MSI makes this surgery unnecessary.\n",
+      );
+    } else if (sanitized.skipped) {
+      process.stderr.write(
+        `[viber-codex-bridge] #500: MSIX alias dirs left on the codex child's PATH — ${sanitized.skipped}. ` +
+          "Commands may fail with CreateProcessAsUserW failed: 5; run scripts/repro-codex-spawn.ps1.\n",
+      );
+    }
     if (mcp) {
       args.push("-c", `mcp_servers.viber.url="${mcp.url}"`);
       args.push("-c", `mcp_servers.viber.bearer_token_env_var="${mcp.bearerEnvVar}"`);