bazaar-contrib-codex 0.3.0rc1__py3-none-any.whl

bazaar_contrib_codex/__init__.py

@@ -0,0 +1,78 @@
+"""Register the Codex builder and its privately composed Harness."""
+
+from __future__ import annotations
+
+from contextlib import asynccontextmanager
+from pathlib import Path
+from typing import Any, ClassVar
+
+from bazaar_contrib_audit import AUDIT
+from bazaar_contrib_harness import (
+    HARNESS,
+    HARNESS_BUILDERS,
+    HARNESS_INPUT,
+    HarnessBuilderConfig,
+    HarnessInspection,
+    harness_builder_key,
+)
+from bazaar_contrib_timer import TIMER
+from bazaar_core import Context, Contrib
+from pydantic import BaseModel, ConfigDict
+
+from .inspection import inspect
+from .runtime import CodexHarness
+
+
+class Config(BaseModel):
+    model_config = ConfigDict(frozen=True)
+    model: str | None = None
+    effort: str | None = None
+
+
+@asynccontextmanager
+async def lifespan(ctx: Context, config: Config):
+    instance = CodexHarness(
+        ctx.accept(HARNESS_INPUT),
+        ctx.accept(TIMER),
+        ctx.accept(AUDIT),
+        config.model,
+        config.effort,
+    )
+    ctx.offer(HARNESS, instance)
+    try:
+        yield
+    finally:
+        await instance.aclose()
+
+
+harness = Contrib(
+    config=Config,
+    accepts=[HARNESS_INPUT, TIMER, AUDIT],
+    offers=[HARNESS],
+    lifespan=lifespan,
+)
+
+
+class BuilderConfig(HarnessBuilderConfig):
+    kind: ClassVar[str] = "codex"
+    entity_model: ClassVar[type[BaseModel]] = Config
+    entry: ClassVar[Contrib[Any]] = harness
+
+    @classmethod
+    async def inspect(cls, workspace: Path, *, timeout: float) -> HarnessInspection:  # noqa: ASYNC109
+        return await inspect(workspace, timeout=timeout)
+
+
+@asynccontextmanager
+async def builder_lifespan(ctx: Context, config: BuilderConfig):
+    with ctx.accept(HARNESS_BUILDERS).register(config.builder()) as builder:
+        ctx.offer(harness_builder_key(builder.kind), builder)
+        yield
+
+
+builder = Contrib(
+    config=BuilderConfig,
+    accepts=[HARNESS_BUILDERS],
+    offers=[harness_builder_key("codex")],
+    lifespan=builder_lifespan,
+)

bazaar_contrib_codex/approval.py

@@ -0,0 +1,151 @@
+"""Translate Codex permission requests through the public approval contract."""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from bazaar_contrib_harness import ApprovalHandler, ApprovalRequest, ApprovalScope
+
+from .transport import AppServerError, Packet
+
+logger = logging.getLogger(__name__)
+
+COMMAND = "item/commandExecution/requestApproval"
+FILE = "item/fileChange/requestApproval"
+ELICITATION = "mcpServer/elicitation/request"
+PERMISSIONS = "item/permissions/requestApproval"
+USER_INPUT = "item/tool/requestUserInput"
+
+LABELS = {
+    ApprovalScope.ONCE: "Allow",
+    ApprovalScope.SESSION: "Allow for this session",
+    ApprovalScope.ALWAYS: "Allow and don't ask me again",
+}
+
+
+def decline(packet: Packet) -> dict[str, Any]:
+    match packet.method:
+        case _ if packet.method in (COMMAND, FILE):
+            return {"decision": "decline"}
+        case _ if packet.method == PERMISSIONS:
+            return {"permissions": {}}
+        case _ if packet.method == USER_INPUT:
+            return {
+                "answers": {
+                    question["id"]: {"answers": ["__codex_mcp_decline__"]}
+                    for question in packet.params.get("questions", [])
+                    if question["id"].startswith("mcp_tool_call_approval_")
+                }
+            }
+        case _ if packet.method == ELICITATION:
+            return {"action": "decline", "content": None}
+        case _:
+            raise AppServerError(
+                f"Unsupported Codex server request: {packet.method}", code=-32601
+            )
+
+
+async def interact(
+    packet: Packet,
+    *,
+    session_id: str,
+    turn_id: str,
+    handler: ApprovalHandler,
+    timeout: float,  # noqa: ASYNC109
+) -> dict[str, Any]:
+    params = packet.params
+    scopes = [ApprovalScope.ONCE]
+    amendment = None
+    match packet.method:
+        case _ if packet.method in (COMMAND, FILE):
+            action = "command_execution" if packet.method == COMMAND else "file_change"
+            decisions = params.get("availableDecisions") or []
+            if packet.method == FILE or "acceptForSession" in decisions:
+                scopes.append(ApprovalScope.SESSION)
+            for decision in decisions:
+                match decision:
+                    case {"acceptWithExecpolicyAmendment": _}:
+                        amendment = decision
+                    case {
+                        "applyNetworkPolicyAmendment": {
+                            "network_policy_amendment": {"action": "allow"}
+                        }
+                    }:
+                        amendment = decision
+                if amendment is not None:
+                    break
+            if amendment is not None:
+                scopes.append(ApprovalScope.ALWAYS)
+        case _ if packet.method == PERMISSIONS:
+            action = "permissions"
+            scopes.append(ApprovalScope.SESSION)
+        case _ if packet.method == USER_INPUT:
+            if not params["questions"] or not all(
+                question["id"].startswith("mcp_tool_call_approval_")
+                for question in params["questions"]
+            ):
+                logger.warning("Unsupported Codex user-input request: %s", packet.id)
+                return decline(packet)
+            action = "mcp_tool_approval"
+            labels = {option["label"] for option in params["questions"][0]["options"]}
+            scopes.extend(
+                scope
+                for scope in (ApprovalScope.SESSION, ApprovalScope.ALWAYS)
+                if LABELS[scope] in labels
+            )
+        case _ if packet.method == ELICITATION:
+            metadata = params.get("_meta") or {}
+            if metadata.get("codex_approval_kind") != "mcp_tool_call":
+                logger.warning("Unsupported Codex elicitation request: %s", packet.id)
+                return decline(packet)
+            action = "mcp_tool_approval"
+            scopes.extend(
+                scope
+                for scope in (ApprovalScope.SESSION, ApprovalScope.ALWAYS)
+                if scope.value in metadata.get("persist", [])
+            )
+        case _:
+            logger.warning("Unsupported Codex server request: %s", packet.method)
+            return decline(packet)
+    request = ApprovalRequest(
+        request_id=str(packet.id),
+        session_id=session_id,
+        turn_id=turn_id,
+        action=action,
+        details=params,
+        allowed_scopes=tuple(scopes),
+        **({"created_at_ms": params["startedAtMs"]} if "startedAtMs" in params else {}),
+    )
+    result = await handler.request_approval(request, timeout=timeout)
+    if result.decision != "approved":
+        return decline(packet)
+    match packet.method:
+        case _ if packet.method in (COMMAND, FILE):
+            decision: Any = "accept"
+            if result.scope is ApprovalScope.SESSION:
+                decision = "acceptForSession"
+            elif result.scope is ApprovalScope.ALWAYS:
+                decision = amendment
+            return {"decision": decision}
+        case _ if packet.method == PERMISSIONS:
+            return {
+                "permissions": params["permissions"],
+                "scope": "session" if result.scope is ApprovalScope.SESSION else "turn",
+            }
+        case _ if packet.method == USER_INPUT:
+            return {
+                "answers": {
+                    question["id"]: {"answers": [LABELS[result.scope]]}
+                    for question in params["questions"]
+                }
+            }
+        case _ if packet.method == ELICITATION:
+            response: dict[str, Any] = {
+                "action": "accept",
+                "content": None,
+            }
+            if result.scope is not ApprovalScope.ONCE:
+                response["_meta"] = {"persist": result.scope.value}
+            return response
+    return decline(packet)

bazaar_contrib_codex/inspection.py

@@ -0,0 +1,120 @@
+"""Query Codex metadata without creating an Agent, thread or turn."""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from pathlib import Path
+from typing import Any
+
+from bazaar_contrib_harness import HarnessInspection, HarnessModel, HarnessSkill
+
+from .approval import decline
+from .transport import AppServer, AppServerError, Packet, background
+
+logger = logging.getLogger(__name__)
+
+
+async def inspect(workspace: Path, *, timeout: float) -> HarnessInspection:  # noqa: ASYNC109
+    try:
+        process = await asyncio.create_subprocess_exec(
+            "codex",
+            "--version",
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+    except OSError as error:
+        return HarnessInspection(available=False, error=str(error))
+    try:
+        stdout, stderr = await process.communicate()
+    finally:
+        if process.returncode is None:
+            try:
+                process.kill()
+            except ProcessLookupError:
+                pass
+            background(process.communicate())
+    if process.returncode or not stdout.strip():
+        return HarnessInspection(
+            available=False,
+            error=stderr.decode(errors="replace").strip()
+            or f"codex --version exited ({process.returncode})",
+        )
+    version = stdout.decode(errors="replace").strip().split()[-1]
+    server: AppServer | None = None
+    models: list[HarnessModel] = []
+    skills: tuple[HarnessSkill, ...] = ()
+
+    async def answer(packet: Packet) -> dict[str, Any]:
+        logger.warning("No session owns Codex inspection request %s", packet.id)
+        return decline(packet)
+
+    try:
+        server = await AppServer.start(
+            workspace,
+            {},
+            answer,
+            lambda packet: logger.debug(
+                "Codex inspection notification: %s", packet.method
+            ),
+            timeout=timeout,
+        )
+        await server.initialize()
+        cursor = None
+        while True:
+            page = await server.request("model/list", {"cursor": cursor})
+            models.extend(
+                HarnessModel(
+                    id=item["model"],
+                    name=item["displayName"],
+                    efforts=tuple(
+                        option["reasoningEffort"]
+                        for option in item["supportedReasoningEfforts"]
+                    ),
+                    default_effort=item["defaultReasoningEffort"],
+                    default=item["isDefault"],
+                )
+                for item in page["data"]
+                if not item.get("hidden", False)
+            )
+            cursor = page.get("nextCursor")
+            if cursor is None:
+                break
+        result = await server.request("skills/list", {"cwds": [str(workspace)]})
+        skills = tuple(
+            HarnessSkill(
+                name=skill["name"],
+                description=(skill.get("interface") or {}).get("shortDescription")
+                or skill.get("shortDescription")
+                or skill["description"],
+                source={"repo": "workspace", "user": "personal"}.get(
+                    skill["scope"], "system"
+                ),
+            )
+            for entry in result["data"]
+            for skill in entry["skills"]
+            if skill.get("enabled", True)
+        )
+        return HarnessInspection(
+            available=True,
+            version=version,
+            models=tuple(models),
+            skills=skills,
+            error="\n".join(
+                error["message"]
+                for entry in result["data"]
+                for error in entry.get("errors", [])
+            )
+            or None,
+        )
+    except (AppServerError, OSError) as error:
+        return HarnessInspection(
+            available=True,
+            version=version,
+            models=tuple(models),
+            skills=skills,
+            error=str(error) or type(error).__name__,
+        )
+    finally:
+        if server is not None:
+            server.close(timeout=timeout)