mirror of
https://github.com/wu736139669/hapi.git
synced 2026-08-06 06:41:56 +00:00
This refactoring introduces CLI argument overrides for sandbox and approval policy settings in remote mode, allowing users to specify security constraints via `--sandbox` and `--ask-for-approval` flags. Changes: - Add `CodexCliOverrides` type and `parseCodexCliOverrides()` utility to parse CLI flags like `--sandbox`, `-s`, `--ask-for-approval`, `-a`, along with convenience flags (`--full-auto`, `--dangerously-bypass-approvals-and-sandbox`) - Extract complex start config building logic into `buildCodexStartConfig()` function with proper approval policy and sandbox resolution based on permission mode - Thread `codexCliOverrides` through the session/loop/launcher chain and apply overrides only when permission mode is 'default' - Update `codexRemoteLauncher` to use the new config builder and display appropriate warnings based on whether overrides are present - Add comprehensive tests for both parsing and config building functions
60 lines
2.3 KiB
TypeScript
60 lines
2.3 KiB
TypeScript
import { trimIdent } from '@/utils/trimIdent';
|
|
import type { CodexSessionConfig } from '../types';
|
|
import type { EnhancedMode } from '../loop';
|
|
import type { CodexCliOverrides } from './codexCliOverrides';
|
|
|
|
const TITLE_INSTRUCTION = trimIdent(`Based on this message, call functions.hapi__change_title to change chat session title that would represent the current task. If chat idea would change dramatically - call this function again to update the title.`);
|
|
|
|
function resolveApprovalPolicy(mode: EnhancedMode): CodexSessionConfig['approval-policy'] {
|
|
switch (mode.permissionMode) {
|
|
case 'default': return 'untrusted';
|
|
case 'read-only': return 'never';
|
|
case 'safe-yolo': return 'on-failure';
|
|
case 'yolo': return 'on-failure';
|
|
default: {
|
|
throw new Error(`Unknown permission mode: ${mode.permissionMode}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
function resolveSandbox(mode: EnhancedMode): CodexSessionConfig['sandbox'] {
|
|
switch (mode.permissionMode) {
|
|
case 'default': return 'workspace-write';
|
|
case 'read-only': return 'read-only';
|
|
case 'safe-yolo': return 'workspace-write';
|
|
case 'yolo': return 'danger-full-access';
|
|
default: {
|
|
throw new Error(`Unknown permission mode: ${mode.permissionMode}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
export function buildCodexStartConfig(args: {
|
|
message: string;
|
|
mode: EnhancedMode;
|
|
first: boolean;
|
|
mcpServers: Record<string, { command: string; args: string[] }>;
|
|
cliOverrides?: CodexCliOverrides;
|
|
}): CodexSessionConfig {
|
|
const approvalPolicy = resolveApprovalPolicy(args.mode);
|
|
const sandbox = resolveSandbox(args.mode);
|
|
const allowCliOverrides = args.mode.permissionMode === 'default';
|
|
const cliOverrides = allowCliOverrides ? args.cliOverrides : undefined;
|
|
const resolvedApprovalPolicy = cliOverrides?.approvalPolicy ?? approvalPolicy;
|
|
const resolvedSandbox = cliOverrides?.sandbox ?? sandbox;
|
|
|
|
const prompt = args.first ? `${args.message}\n\n${TITLE_INSTRUCTION}` : args.message;
|
|
const startConfig: CodexSessionConfig = {
|
|
prompt,
|
|
sandbox: resolvedSandbox,
|
|
'approval-policy': resolvedApprovalPolicy,
|
|
config: { mcp_servers: args.mcpServers }
|
|
};
|
|
|
|
if (args.mode.model) {
|
|
startConfig.model = args.mode.model;
|
|
}
|
|
|
|
return startConfig;
|
|
}
|