feat: enforce scoped Codex task reads - #724
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 22dac7a6e1
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| (options.readRoots?.length ?? 0) > 0 && | ||
| /default_permissions|permission profiles?|unknown field.*config|invalid.*permissions/i.test(message) | ||
| ) { |
There was a problem hiding this comment.
When this runs against Codex older than 0.138, thread/start can succeed while ignoring the unrecognized default_permissions and permissions keys; codex app-server --help documents --strict-config as the option that errors on unrecognized fields, while SpawnedCodexAppServerClient launches without it. This catch is therefore never reached, sandbox has been omitted, and a task advertised as confined can receive the runtime's default full-read access. Check a runtime capability/version before starting or verify that the response selected claude_companion_scoped.
Useful? React with 👍 / 👎.
| throw new Error("Choose either --resume/--resume-last or --fresh."); | ||
| } | ||
| const write = Boolean(options.write); | ||
| const readRoots = (options["read-root"] ?? []).map((readRoot) => resolveReadRoot(cwd, readRoot)); |
There was a problem hiding this comment.
When the helper uses its documented single-raw-argument invocation, an input such as --read-root "" src inspect is tokenized by splitRawArgumentString without the quoted empty token. If src is an existing directory, this line consequently validates src as the root and runs with inspect as the prompt instead of rejecting the empty root as promised. Preserve empty quoted tokens during raw tokenization or reject this form before parsing.
Useful? React with 👍 / 👎.
1 participant
Summary
--read-root <directory>support for Codex task and rescue flowsVerification
npm test(97 passed)npm run buildnode scripts/bump-version.mjs --check 1.0.11claude plugin validate plugins/codexgit diff --check