optio-codex 0.2.0__tar.gz → 0.3.0__tar.gz

{optio_codex-0.2.0 → optio_codex-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: optio-codex
-Version: 0.2.0
+Version: 0.3.0
 Summary: Run OpenAI Codex as an optio task; local subprocess; ttyd-served TUI iframe.
 Author-email: Kristof Csillag <kristof.csillag@deai-labs.com>
 License-Expression: Apache-2.0
@@ -22,7 +22,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: optio-core<0.4,>=0.3
 Requires-Dist: optio-host<0.3,>=0.2
-Requires-Dist: optio-agents<0.5,>=0.4
+Requires-Dist: optio-agents<0.6,>=0.5
 Requires-Dist: asyncssh>=2.14
 Requires-Dist: aiohttp>=3.9
 Provides-Extra: dev

{optio_codex-0.2.0 → optio_codex-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "optio-codex"
-version = "0.2.0"
+version = "0.3.0"
 description = "Run OpenAI Codex as an optio task; local subprocess; ttyd-served TUI iframe."
 readme = "README.md"
 license = "Apache-2.0"
@@ -28,7 +28,7 @@ classifiers = [
 dependencies = [
     "optio-core>=0.3,<0.4",
     "optio-host>=0.2,<0.3",
-    "optio-agents>=0.4,<0.5",
+    "optio-agents>=0.5,<0.6",
     "asyncssh>=2.14",
     "aiohttp>=3.9",
 ]

{optio_codex-0.2.0 → optio_codex-0.3.0}/src/optio_codex/__init__.py

@@ -9,6 +9,7 @@ from optio_host import (
     SSHConfig,
 )
 
+from optio_codex.info import AGENT_INFO
 from optio_codex.seed_manifest import (
     CODEX_CRED_MANIFEST,
     CODEX_SEED_MANIFEST,
@@ -38,6 +39,7 @@ _logging.getLogger("asyncssh").setLevel(_logging.WARNING)
 
 
 __all__ = [
+    "AGENT_INFO",
     "create_codex_task",
     "run_codex_session",
     "AllowedDir",

{optio_codex-0.2.0 → optio_codex-0.3.0}/src/optio_codex/conversation.py

@@ -101,6 +101,7 @@ from optio_agents.conversation import (
     PermissionRequest,
 )
 from optio_codex import models as codex_models
+from optio_codex.info import AGENT_INFO
 
 _LOG = logging.getLogger(__name__)
 
@@ -120,7 +121,7 @@ class CodexConversation:
         self,
         *,
         cwd: str,
-        agent_label: str = "codex",
+        agent_label: str = AGENT_INFO.slug,
         permission_gate: bool = False,
         model: str | None = None,
         reasoning_effort: str | None = None,

{optio_codex-0.2.0 → optio_codex-0.3.0}/src/optio_codex/host_actions.py

@@ -13,6 +13,8 @@ from datetime import datetime, timezone
 from typing import TYPE_CHECKING
 
 from optio_agents import RESUME_NOTICE, SYSTEM_MESSAGE_PREFIX
+from optio_agents import claustrum
+from optio_agents import pane_surfacing
 from optio_agents import tmux_input as _tmux_input
 from optio_host.host import proc_wait
 
@@ -146,6 +148,65 @@ async def _resolve_codex_cache_dir(host: "Host", override: str | None) -> str:
     return path.rstrip("/")
 
 
+async def ensure_claustrum_installed(
+    hook_ctx: "HookContextProtocol",
+    *,
+    install_dir: str | None = None,
+) -> str:
+    """Ensure a functioning claustrum binary (pinned tag, host arch) is on the
+    host, and return its path.
+
+    Thin wrapper over :func:`optio_agents.claustrum.ensure_claustrum_installed`:
+    it resolves the codex-owned target cache dir (on the worker) and the
+    engine-local build cache root, then delegates the cross-compile/place/
+    validate to the shared module (fail-closed, functional probe, ELF-guarded
+    build cache). The codex-owned grant set + wrap live in
+    ``session._build_claustrum_wrap``. Claustrum — not codex's native sandbox —
+    is the trusted fs-isolation layer: the native sandbox confines shell-exec
+    commands but the codex agent's OWN process tree is only whole-tree confined
+    by the outer Landlock ruleset; the native mode is kept for the network knob.
+    """
+    host = hook_ctx._host
+    cache_dir = await _resolve_codex_cache_dir(host, install_dir)
+    return await claustrum.ensure_claustrum_installed(
+        host,
+        cache_dir=cache_dir,
+        engine_cache_dir=os.path.expanduser("~/.cache/optio-codex"),
+        report_progress=hook_ctx.report_progress,
+    )
+
+
+async def claustrum_newer_tag() -> str | None:
+    """Return the newest claustrum tag if it is newer than the pinned one, else None.
+
+    Engine-side egress only. Best-effort: network failure returns None (no
+    notice). Mirrors the claudecode/cursor shim.
+    """
+    try:
+        p = await asyncio.create_subprocess_exec(
+            "git", "ls-remote", "--tags", "--refs", claustrum.CLAUSTRUM_REPO,
+            stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.DEVNULL,
+        )
+        out, _ = await p.communicate()
+        if p.returncode != 0:
+            return None
+    except Exception:  # noqa: BLE001
+        return None
+    tags = []
+    for line in out.decode().splitlines():
+        ref = line.rsplit("/", 1)[-1].strip()
+        if ref.startswith("v"):
+            tags.append(ref)
+
+    def key(t: str) -> tuple:
+        return tuple(int(x) for x in t.lstrip("v").split(".") if x.isdigit())
+
+    if not tags:
+        return None
+    newest = max(tags, key=key)
+    return newest if key(newest) > key(claustrum.CLAUSTRUM_PINNED_TAG) else None
+
+
 async def ensure_codex_installed(
     hook_ctx: "HookContextProtocol",
     *,
@@ -525,6 +586,7 @@ def _build_codex_shell_command(
     workdir: str,
     extra_env: dict[str, str] | None,
     codex_flags: list[str],
+    claustrum_wrap: list[str] | None = None,
 ) -> tuple[list[str], str]:
     workdir_clean = workdir.rstrip("/")
     iso = _isolation_env(workdir_clean)
@@ -541,9 +603,24 @@ def _build_codex_shell_command(
     for k, v in extra.items():
         env_assignments.append(f"{k}={v}")
 
-    codex_argv = " ".join(shlex.quote(c) for c in [codex_path, *codex_flags])
+    # Stage 9: when fs_isolation is on, ``claustrum_wrap`` is the claustrum
+    # argv prefix (``claustrum … --``) that Landlock-confines codex + its whole
+    # subprocess tree. None ⇒ unconfined (fs_isolation off).
+    codex_argv = " ".join(
+        shlex.quote(c) for c in [*(claustrum_wrap or []), codex_path, *codex_flags]
+    )
     log_path = f"{workdir_clean}/optio.log"
 
+    # ALWAYS-ON launch-failure surfacing: on abnormal exit, tail the tmux
+    # pane mirror (codex-pane.log, written live by `tmux pipe-pane` in
+    # launch_ttyd_with_codex) into optio.log after the ERROR line, so the real
+    # failure — whatever codex paints before exiting — is not swallowed. The
+    # mirror uses pipe-pane INSTEAD of a stdout/stderr redirect because a
+    # redirect makes isatty() false and the TUI never renders. The pane_log is
+    # derived from the same workdir the launch mirror uses, so both resolve to
+    # the same file.
+    pane_log = pane_surfacing.pane_log_path(workdir_clean, "codex")
+
     if path_override is not None:
         path_expr = (
             f"export PATH={shlex.quote(f'{home_local_bin}:{path_override}')}; "
@@ -554,7 +631,10 @@ def _build_codex_shell_command(
         f"{path_expr}"
         f"cd {shlex.quote(workdir_clean)} && {codex_argv}; rc=$?; "
         f'if [ "$rc" = 0 ]; then echo DONE >> {shlex.quote(log_path)}; '
-        f"else printf 'ERROR: codex exited %s\\n' \"$rc\" >> {shlex.quote(log_path)}; fi"
+        f"else "
+        f"printf 'ERROR: codex exited %s\\n' \"$rc\" >> {shlex.quote(log_path)}; "
+        f"{pane_surfacing.error_tail_snippet(log_path, pane_log, 'codex')}"
+        f"fi"
     )
     shell_command = "env " + " ".join(
         shlex.quote(x) for x in [*env_assignments, "bash", "-c", bash_payload]
@@ -707,12 +787,14 @@ def build_tmux_session_argv(
     session_name: str,
     extra_env: dict[str, str] | None,
     codex_flags: list[str],
+    claustrum_wrap: list[str] | None = None,
 ) -> list[str]:
     _, shell_command = _build_codex_shell_command(
         codex_path=codex_path,
         workdir=workdir,
         extra_env=extra_env,
         codex_flags=codex_flags,
+        claustrum_wrap=claustrum_wrap,
     )
     return [
         tmux_path, "-S", socket_path, "new-session", "-d",
@@ -781,6 +863,7 @@ async def launch_ttyd_with_codex(
     bind_iface: str,
     extra_env: dict[str, str] | None,
     codex_flags: list[str],
+    claustrum_wrap: list[str] | None = None,
     ready_timeout_s: float = 30.0,
     env_remove: list[str] | None = None,
     session_name: str = "optio",
@@ -797,12 +880,25 @@ async def launch_ttyd_with_codex(
         session_name=session_name,
         extra_env=extra_env,
         codex_flags=codex_flags,
+        claustrum_wrap=claustrum_wrap,
     )
     session_cmd = " ".join(shlex.quote(a) for a in session_argv)
     await _launch_detached_checked(
         host, session_cmd, env_remove=env_remove, what="tmux new-session",
     )
 
+    # ALWAYS-ON pane mirror: duplicate the live pane to codex-pane.log (outside
+    # the workdir, so it survives the workdir teardown on failure). pipe-pane
+    # copies the PTY output stream — it does NOT insert a pipe in codex's fd
+    # chain, so the TUI is unaffected (a stdout/stderr redirect would make
+    # isatty() false and the TUI would never render). The launch payload tails
+    # this on abnormal exit (see _build_codex_shell_command).
+    pane_log = pane_surfacing.pane_log_path(host.workdir, "codex")
+    await host.run_command(pane_surfacing.mkdir_pane_dir_cmd(pane_log))
+    await host.run_command(
+        pane_surfacing.pipe_pane_cmd(tmux_path, socket_path, session_name, pane_log)
+    )
+
     ttyd_argv = build_ttyd_attach_argv(
         ttyd_path=ttyd_path,
         tmux_path=tmux_path,

optio_codex-0.3.0/src/optio_codex/info.py

@@ -0,0 +1,7 @@
+from optio_agents import AgentInfo
+
+AGENT_INFO = AgentInfo(
+    slug="codex",
+    name="Codex",
+    url="https://openai.com/codex",
+)

{optio_codex-0.2.0 → optio_codex-0.3.0}/src/optio_codex/session.py

@@ -24,6 +24,7 @@ from optio_host.paths import task_dir
 
 from optio_codex import cred_watcher, host_actions
 from optio_codex import models as codex_models
+from optio_codex.info import AGENT_INFO
 from optio_codex.conversation import CodexConversation
 from optio_codex.conversation_listener import ConversationListener
 from optio_codex.fs_allowlist import (
@@ -54,6 +55,41 @@ def _build_host(config: CodexTaskConfig, process_id: str) -> Host:
     return host_actions.build_host(config.ssh, taskdir)
 
 
+async def _build_claustrum_wrap(
+    host: Host, config: CodexTaskConfig, claustrum_path: str | None,
+) -> list[str] | None:
+    """claustrum argv prefix for an fs-isolated launch, or None when
+    fs_isolation is off. Shared by the iframe and conversation launch paths so
+    both confine codex + its whole subprocess tree identically.
+
+    ``workdir`` (incl. the isolated home) is granted rwx; the codex binary cache
+    (where the ``<workdir>/home/.local/bin/codex`` symlink targets, outside the
+    workdir) is granted read+exec so codex can exec itself. ``~/`` caller extras
+    expand against the REAL host home (codex runs under an isolated $HOME, and
+    grants reach claustrum verbatim — no shell between). Consumes the shared
+    ``optio_agents.fs_grants`` + ``optio_agents.claustrum`` helpers.
+    """
+    if not config.fs_isolation:
+        return None
+    from optio_agents import fs_grants
+    cache_dir = await host_actions._resolve_codex_cache_dir(host, config.install_dir)
+    host_home = (
+        await host.resolve_host_home() if config.extra_allowed_dirs else None
+    )
+    grants = fs_grants.build_grant_flags(
+        workdir=host.workdir,
+        engine_cache_dir=cache_dir,
+        extra_allowed_dirs=config.extra_allowed_dirs,
+        host_home=host_home,
+        # codex writes temp files under /tmp (its _isolation_env sets HOME/
+        # CODEX_HOME/XDG_* but NOT TMPDIR, so tempfile falls back to /tmp), so
+        # claustrum must grant /tmp (+ /var/tmp) or those writes are denied.
+        # codex-specific: the other engines confine temp to the workdir.
+        extra_baseline=[("--rw", "/tmp"), ("--rw", "/var/tmp")],
+    )
+    return host_actions.claustrum.build_claustrum_wrap(claustrum_path, grants)
+
+
 async def _call_maybe_async(fn, *args) -> None:
     """Invoke a callback that may be sync or async."""
     result = fn(*args)
@@ -98,6 +134,13 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
     # build_sandbox_cli_args; the codex app-server launch via thread/start's
     # `sandbox` mode + build_sandbox_config_overrides in the conversation body).
     sandbox_settings: SandboxSettings | None = None
+    # Stage 9: claustrum (Landlock, fail-closed) is the fs-isolation guarantee.
+    # Provisioned once in _prepare when fs_isolation is on; the resolved binary
+    # path feeds every launch surface's claustrum wrap. ``claustrum_newer`` is
+    # the newest upstream tag when it exceeds the pinned one (drives the update
+    # notice), else None.
+    claustrum_path: str | None = None
+    claustrum_newer: str | None = None
     cancelled = False
     # Whether a snapshot was restored this run (suppresses the auto-start
     # positional). Set by _prepare, read by the body.
@@ -152,7 +195,7 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
         """
         nonlocal codex_path, ttyd_path, resuming, resume_session_id
         nonlocal resolved_seed_id, lease_holder, cred_baseline
-        nonlocal sandbox_settings
+        nonlocal sandbox_settings, claustrum_path, claustrum_newer
 
         resume_requested = bool(getattr(ctx, "resume", False))
         snapshot = None
@@ -193,6 +236,25 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
         # renders from this single object.
         host_home = await host.resolve_host_home()
         sandbox_settings = resolve_sandbox_settings(config, host_home=host_home)
+        # Stage 9: provision claustrum (Landlock, fail-closed) — the trusted fs
+        # guarantee. Any failure RAISES here, so the launch never proceeds
+        # unconfined. claustrum_newer drives the update notice below.
+        if config.fs_isolation:
+            claustrum_path = await host_actions.ensure_claustrum_installed(
+                hook_ctx, install_dir=config.install_dir,
+            )
+            claustrum_newer = await host_actions.claustrum_newer_tag()
+            # SECURITY: under claustrum codex runs danger-full-access (its native
+            # bubblewrap sandbox can't nest inside Landlock), so codex's NETWORK
+            # is NOT confined — the network_access knob is a no-op here. Make the
+            # gap loud. The pending shared pasta/netns layer will close it.
+            _LOG.warning(
+                "codex fs is claustrum-confined, but its NETWORK is UNCONFINED "
+                "(bubblewrap can't nest in claustrum; network_access=%s is a "
+                "no-op under fs_isolation). Network isolation pending the shared "
+                "pasta/netns layer.",
+                config.network_access,
+            )
         # Conversation mode is headless (codex app-server stdio) — no ttyd.
         if config.mode != "conversation":
             ttyd_path = await host_actions.ensure_ttyd_installed(
@@ -252,6 +314,18 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
             await host_actions._append_resume_log_entry(
                 host, refreshed=refreshed_files,
             )
+        # Stage 9: if a newer claustrum release exists, route the security
+        # notice through on_deliverable (a new release may patch a
+        # vulnerability). No-op without a callback or a newer tag. Runs for both
+        # iframe and conversation modes.
+        if config.fs_isolation and claustrum_newer:
+            await host_actions.claustrum.emit_claustrum_update_notice(
+                host, hook_ctx,
+                delivery_type=config.delivery_type,
+                on_deliverable=config.on_deliverable,
+                newer=claustrum_newer,
+                pinned=host_actions.claustrum.CLAUSTRUM_PINNED_TAG,
+            )
         if config.before_execute is not None:
             # End-of-prepare placement matches claudecode (its
             # _plant_session_content ends with before_execute, inside its
@@ -290,7 +364,10 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
             **(config.env or {}),
             **(hook_ctx.browser_launch_env or {}),
         }
-        ctx.report_progress(None, "Launching Codex…")
+        # Stage 9: Landlock-confine codex + its whole tmux/bash subprocess tree
+        # (None when fs_isolation is off).
+        claustrum_wrap = await _build_claustrum_wrap(host, config, claustrum_path)
+        ctx.report_progress(None, f"Launching {AGENT_INFO.name}…")
         handle, tmux_path_local, ttyd_port, tmux_socket, tmux_session = await host_actions.launch_ttyd_with_codex(
             host,
             ttyd_path=ttyd_path,
@@ -298,6 +375,7 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
             bind_iface=ttyd_iface,
             extra_env=launch_env,
             codex_flags=codex_flags,
+            claustrum_wrap=claustrum_wrap,
             ready_timeout_s=READY_TIMEOUT_S,
             env_remove=config.scrub_env,
         )
@@ -309,7 +387,7 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
         await ctx.set_widget_data({
             "iframeSrc": "{widgetProxyUrl}/",
         })
-        ctx.report_progress(None, "Codex is live")
+        ctx.report_progress(None, f"{AGENT_INFO.name} is live")
 
         # iframe-input widget: start the engine-side input listener and publish it
         # as the control upstream. The operator types messages / drives TUI menus
@@ -373,7 +451,11 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
             # thread id recorded in the restored snapshot.
             resume_thread_id=resume_session_id if resuming else None,
         )
+        # Stage 9: Landlock-confine the app-server process tree (None when
+        # fs_isolation is off).
+        claustrum_wrap = await _build_claustrum_wrap(host, config, claustrum_path)
         argv = [
+            *(claustrum_wrap or []),
             codex_path, "app-server",
             *build_sandbox_config_overrides(sandbox_settings),
         ]
@@ -383,7 +465,7 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
             **(config.env or {}),
             **(hook_ctx.browser_launch_env or {}),
         }
-        ctx.report_progress(None, "Launching Codex (conversation)…")
+        ctx.report_progress(None, f"Launching {AGENT_INFO.name} (conversation)…")
         handle = await host.launch_subprocess(
             cmd, env=env, cwd=host.workdir,
             env_remove=config.scrub_env, stdin=True, merge_stderr=False,
@@ -398,7 +480,7 @@ async def run_codex_session(ctx: ProcessContext, config: CodexTaskConfig) -> Non
             raise
 
         ctx.publish_result(conversation)
-        ctx.report_progress(None, "Codex conversation is live")
+        ctx.report_progress(None, f"{AGENT_INFO.name} conversation is live")
 
         # Opt-in dashboard chat widget: per-task SSE listener over the
         # published conversation, reached via the widget proxy (which injects

{optio_codex-0.2.0 → optio_codex-0.3.0}/src/optio_codex/types.py

@@ -32,6 +32,7 @@ from optio_agents import (
     ThinkingVerbosity,
     ToolVerbosity,
 )
+from optio_agents.config_types import ClaustrumConfigMixin
 from optio_agents.protocol.session import (
     CallerMessageCallback,
     DeliverableCallback,
@@ -90,13 +91,16 @@ def _identity_resume_refresh(config: "CodexTaskConfig") -> "CodexTaskConfig":
     return config
 
 
-@dataclass
-class CodexTaskConfig:
-    """Configuration for one optio-codex task instance (Stage 0).
+@dataclass(frozen=True, kw_only=True)
+class CodexTaskConfig(ClaustrumConfigMixin):
+    """Configuration for one optio-codex task instance.
 
-    Stages 0-2 cover iframe/ttyd mode on local and SSH-remote hosts with
-    resume/snapshots. Seeds, conversation mode, and filesystem isolation
-    arrive in later stages.
+    Inherits the claustrum filesystem-isolation triad (``fs_isolation`` /
+    ``extra_allowed_dirs`` / ``delivery_type``) from ``ClaustrumConfigMixin``;
+    those fields stay top-level here (callers write ``fs_isolation=`` /
+    ``delivery_type=`` verbatim). Frozen because the mixin is frozen;
+    ``kw_only`` because the mixin contributes defaulted fields ahead of the
+    required ``consumer_instructions``.
     """
 
     consumer_instructions: str
@@ -124,27 +128,33 @@ class CodexTaskConfig:
     # watching). In conversation mode the thread's approvalPolicy is derived
     # from permission_gate (never / on-request), NOT from this field.
     ask_for_approval: ApprovalPolicy = "never"
-    # codex-native sandbox mode. None (default) derives from fs_isolation:
-    # workspace-write when isolation is on, danger-full-access when off.
-    # Explicit values are cross-validated against fs_isolation below.
+    # codex-native sandbox mode. Claustrum (see session.py), NOT this native
+    # mode, owns filesystem isolation. codex's native sandbox is BUBBLEWRAP,
+    # which cannot nest inside claustrum, so with fs_isolation=True (default) the
+    # native mode MUST be danger-full-access (no bwrap) — None (default) resolves
+    # to danger-full-access, and an explicit workspace-write/read-only +
+    # fs_isolation is rejected. Set fs_isolation=False to run codex's native
+    # sandbox standalone (then None → workspace-write is NOT auto-picked; pass an
+    # explicit sandbox=). Decoupled from ``fs_isolation``.
     sandbox: SandboxMode | None = None
-    # Grant network to sandboxed tool commands (codex workspace-write default
-    # is network OFF — [sandbox_workspace_write] network_access). False
-    # mirrors codex; note this is STRICTER than grok/claudecode, whose fs
-    # sandboxes do not restrict the network at all.
+    # Grant network to sandboxed tool commands. This is a native-bubblewrap
+    # ([sandbox_workspace_write]) knob and therefore applies ONLY when codex runs
+    # its native workspace-write sandbox standalone (fs_isolation=False,
+    # sandbox='workspace-write'). Under claustrum (fs_isolation=True) codex has NO
+    # network confinement — bwrap can't nest — so this field is a NO-OP there and
+    # session.py warns at launch. The pending shared pasta/netns layer will
+    # restore network isolation universally.
     network_access: bool = False
 
-    # --- filesystem isolation (Stage 8) ---------------------------------
-    # Confine codex tool subprocesses to the task workdir + /tmp + explicit
-    # rw grants, kernel-enforced via codex's NATIVE sandbox (bundled
-    # bubblewrap primary, Landlock+seccomp fallback on Linux). Default-ON.
-    fs_isolation: bool = True
-    # Additional path grants beyond the workdir + temp dirs. ``~/`` expands
-    # against the real host home at launch. "ro" grants are a documented
-    # no-op on codex (reads are unrestricted in workspace-write). codex's
-    # native sandbox has no execute bit, so a ``rox`` grant is treated as
-    # ``ro`` and a ``rwx`` grant as ``rw``.
-    extra_allowed_dirs: list[AllowedDir] | None = None
+    # --- filesystem isolation ------------------------------------------------
+    # fs_isolation / extra_allowed_dirs / delivery_type are INHERITED from
+    # ClaustrumConfigMixin. Claustrum (Landlock, fail-closed) confines codex
+    # and its whole tool-subprocess tree to the task workdir + explicit grants;
+    # ``extra_allowed_dirs`` rw grants ALSO feed codex's native ``writable_roots``
+    # so the redundant native layer never blocks a write claustrum permits.
+    # ``~/`` grants expand against the real host home at launch. delivery_type
+    # is MANDATORY when fs_isolation is on (routes the "newer claustrum
+    # available" security notice via on_deliverable).
 
     ssh: SSHConfig | None = None
 
@@ -263,11 +273,23 @@ class CodexTaskConfig:
 
     @property
     def effective_sandbox_mode(self) -> SandboxMode:
+        # Claustrum (Landlock, see session.py) is the sole fs-isolation layer.
+        # codex's NATIVE sandbox (bubblewrap) CANNOT nest inside claustrum — its
+        # user+mount-namespace setup fails ("setting up uid map / make / slave:
+        # Permission denied") because Landlock denies the /proc write and the
+        # mount-propagation op. So under claustrum the native sandbox is DISABLED
+        # (danger-full-access = no bwrap) and claustrum alone confines the fs.
+        # Consequence: network confinement (a bubblewrap-only feature) is
+        # unavailable here — session.py warns at launch; the pending shared
+        # pasta/netns layer will restore it. Explicit ``sandbox=`` is honored
+        # (power-user escape hatch), but workspace-write/read-only + fs_isolation
+        # is rejected in __post_init__ (it would try to nest bwrap and fail).
         if self.sandbox is not None:
             return self.sandbox
-        return "workspace-write" if self.fs_isolation else "danger-full-access"
+        return "danger-full-access"
 
     def __post_init__(self) -> None:
+        self._validate_claustrum()
         if self.mode not in _VALID_MODES:
             raise ValueError(
                 f"CodexTaskConfig.mode={self.mode!r} is not one of "
@@ -340,20 +362,22 @@ class CodexTaskConfig:
                 f"CodexTaskConfig.reasoning_effort={self.reasoning_effort!r} "
                 f"is not one of {sorted(_VALID_REASONING_EFFORTS)}"
             )
-        if self.fs_isolation and self.effective_sandbox_mode == "danger-full-access":
+        # fs_isolation drives CLAUSTRUM (see session.py). codex's native
+        # bubblewrap sandbox cannot nest inside claustrum's Landlock domain, so
+        # an explicit restrictive native mode + fs_isolation is a hard error:
+        # the launch would try to start bwrap under claustrum and fail-closed.
+        if self.fs_isolation and self.sandbox in ("workspace-write", "read-only"):
             raise ValueError(
-                "CodexTaskConfig: fs_isolation=True is incompatible with "
-                "sandbox='danger-full-access' — fs_isolation exists to "
-                "guarantee a kernel-enforced sandbox. Set fs_isolation=False "
-                "to run unconfined."
-            )
-        if not self.fs_isolation and self.sandbox in ("read-only", "workspace-write"):
-            raise ValueError(
-                "CodexTaskConfig: fs_isolation=False launches codex "
-                "unconfined (danger-full-access); an explicit restrictive "
-                f"sandbox={self.sandbox!r} contradicts it. Drop one of the "
-                "two settings."
+                f"CodexTaskConfig: sandbox={self.sandbox!r} (codex's native "
+                "bubblewrap sandbox) cannot run inside claustrum — bwrap's "
+                "user/mount-namespace setup fails under Landlock. With "
+                "fs_isolation=True, claustrum is the fs sandbox and the native "
+                "mode must be danger-full-access (the default). Set "
+                "fs_isolation=False to use codex's native sandbox standalone."
             )
+        # Native-mode-internal couplings (apply only with fs_isolation=False +
+        # an explicit native mode): rw grants + network both need workspace-write,
+        # since read-only carries neither.
         rw_extras = [
             d for d in (self.extra_allowed_dirs or []) if d.mode in ("rw", "rwx")
         ]

{optio_codex-0.2.0 → optio_codex-0.3.0}/src/optio_codex.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: optio-codex
-Version: 0.2.0
+Version: 0.3.0
 Summary: Run OpenAI Codex as an optio task; local subprocess; ttyd-served TUI iframe.
 Author-email: Kristof Csillag <kristof.csillag@deai-labs.com>
 License-Expression: Apache-2.0
@@ -22,7 +22,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: optio-core<0.4,>=0.3
 Requires-Dist: optio-host<0.3,>=0.2
-Requires-Dist: optio-agents<0.5,>=0.4
+Requires-Dist: optio-agents<0.6,>=0.5
 Requires-Dist: asyncssh>=2.14
 Requires-Dist: aiohttp>=3.9
 Provides-Extra: dev

{optio_codex-0.2.0 → optio_codex-0.3.0}/src/optio_codex.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ src/optio_codex/conversation_listener.py
 src/optio_codex/cred_watcher.py
 src/optio_codex/fs_allowlist.py
 src/optio_codex/host_actions.py
+src/optio_codex/info.py
 src/optio_codex/models.py
 src/optio_codex/prompt.py
 src/optio_codex/seed_manifest.py
@@ -18,7 +19,9 @@ src/optio_codex.egg-info/SOURCES.txt
 src/optio_codex.egg-info/dependency_links.txt
 src/optio_codex.egg-info/requires.txt
 src/optio_codex.egg-info/top_level.txt
+tests/test_agent_info.py
 tests/test_await_codex_gone.py
+tests/test_claustrum.py
 tests/test_codex_cache.py
 tests/test_config.py
 tests/test_config_hooks.py

{optio_codex-0.2.0 → optio_codex-0.3.0}/src/optio_codex.egg-info/requires.txt

@@ -1,6 +1,6 @@
 optio-core<0.4,>=0.3
 optio-host<0.3,>=0.2
-optio-agents<0.5,>=0.4
+optio-agents<0.6,>=0.5
 asyncssh>=2.14
 aiohttp>=3.9
 

optio_codex-0.3.0/tests/test_agent_info.py

@@ -0,0 +1,15 @@
+from optio_codex import AGENT_INFO
+from optio_codex.types import CodexTaskConfig
+
+
+def test_agent_info_values():
+    assert AGENT_INFO.slug == "codex"
+    assert AGENT_INFO.name == "Codex"
+    assert AGENT_INFO.url == "https://openai.com/codex"
+
+
+def test_agent_info_slug_matches_agent_type():
+    import dataclasses
+
+    fields = {f.name: f for f in dataclasses.fields(CodexTaskConfig)}
+    assert fields["agent_type"].default == AGENT_INFO.slug