security(daemon): hide shared Codex auth from model-authored tools

[philz3906]

Problem

AgentConnect's Linux shared-login path deliberately keeps the ACP runtime trusted:

• the private CODEX_HOME/auth.json is a symlink to the exact host auth.json;
• the outer SRT sandbox re-opens that exact file so Codex can authenticate and refresh it;
• the host HOME and unrelated runtime state remain hidden.

That is sufficient for outer host isolation, but it does not separate the trusted Codex parent from model-authored local commands.

@agentclientprotocol/codex-acp@1.1.7 sends a legacy sandbox policy on every turn:

• read-only -> readOnly
• agent -> workspaceWrite
• agent-full-access -> dangerFullAccess

The legacy read-only/workspace-write policies constrain writes, but allow reads of files visible to the Codex process. Because the outer sandbox intentionally exposes the shared auth.json, a model-authored command can read it. AgentConnect already records the file in protectedCredentialRoots, but only the Claude session path consumes those roots today.

This is not an outer SRT escape. It is the missing inner credential boundary inside the trusted Codex runtime namespace.

Verified capability and adapter gap

• codex-acp 1.1.7 bundles @openai/codex ^0.145.0.
• codex-acp upstream main still uses the same legacy per-turn sandboxPolicy path as of f41dcf16.
• Codex 0.145 app-server supports the experimental named permissions field on thread start/resume, and Codex permission profiles support exact filesystem deny rules.
• codex-acp already opts into the app-server experimental API, but it does not pass a permission-profile id on thread start/resume or mode changes. It also overrides each turn with the legacy policy.
• Therefore adding default_permissions to CODEX_CONFIG alone is not a sufficient fix: the adapter's explicit legacy turn policy wins.

Primary references:

• codex-acp 1.1.7 AgentMode
• codex-acp current CodexAcpClient
• Codex 0.145 app-server thread permissions
• Codex permission profiles

Implementation direction

1. Keep codex-acp/Codex as the trusted parent and retain shared host login/refresh.
2. Add codex-acp support for selecting a named permission profile on thread start, resume, and mode changes; omit the conflicting legacy sandbox field/policy while a profile is active.
3. Build the profile only from daemon-owned protected credential roots. Agent config and model output must never supply host paths.
4. Preserve the semantics of all three ACP modes while keeping credential paths denied, including agent-full-access.
5. Preserve additional workspace directories, AgentConnect-injected MCP, account-app disabling, and session resume.
6. Prefer an upstream codex-acp change. Do not add an AgentConnect terminal provider or credential broker unless the native permission-profile path proves insufficient.

Acceptance criteria

• Host codex login, authentication status, token refresh, and subsequent sessions continue to work.
• A Linux no-secret canary confirms model-authored commands cannot read either the private symlink or its host target.
• read-only, agent, and agent-full-access retain their advertised write/network/approval behavior while the credential deny remains mandatory.
• New, resumed, and mode-switched sessions apply the same protected profile.
• The outer SRT boundary still denies the host HOME, daemon root, sibling agents, shared temp, and unrelated runtime state.
• The validated/pinned codex-acp version includes the required permission-profile support.

Out of scope

• A general credential broker/provider proxy.
• Unsandboxed ACP runtimes.
• macOS Keychain and Windows credential handling.

[zfy0701]

Status update (2026-08-02): the codex-acp implementation is ready in agentconnect-md/codex-acp#3 at da5af3f. Exact-head CI, typecheck, build, and 347 tests pass, with no open review threads. The adapter now installs trusted launch-configured permission profiles, validates matching session metadata, applies them on new/resume/load/mode change, preserves runtime workspace roots and approvalsReviewer independently, and omits the conflicting legacy per-turn sandbox policy. Linux canaries verified read-only, workspace, and full-access behavior while both the private Codex state root and canonical host auth target remain denied; a real app-server session also completed with auto_review configured. The outer SRT boundary is unchanged. AgentConnect integration is committed and pushed at bd58d85 on codex/codex-inner-sandbox and pins the intended package version 1.1.8-agentconnect.2. Remaining release gate: merge codex-acp PR #3, publish tag agentconnect-v1.1.8-agentconnect.2, verify npm contents, then open and canary the AgentConnect PR.

[zfy0701]

Superseding the earlier implementation note: the design has been reduced so codex-acp no longer parses credential paths or AgentConnect session metadata. PR #3 now exposes only a generic launch-wide permission-profile bridge at c84e801: the trusted launcher supplies opaque app-server config overrides plus an ACP mode-to-profile mapping; codex-acp selects the profile on new/resume/mode change and omits the legacy per-turn sandbox policy. AgentConnect owns canonical credential roots and all profile construction at 2d170f5. Exact-head CI is green, 345 fork tests and 46 focused daemon tests pass, and an agent-0 ChatGPT-auth canary verified read-only/full-access/agent switches, auto_review on the turn, no legacy turn policy, and denial of a random marker. The remaining gate is still merge/publish of 1.1.8-agentconnect.2 before opening the pinned AgentConnect PR.

[zfy0701]

Status update (2026-08-02): fork main is now linearly rebased onto upstream codex-acp 1.1.9, with the four AgentConnect commits on top at c933cef. The scoped package 1.1.9-agentconnect.1 was published successfully and the npm agentconnect dist-tag resolves to it. AgentConnect PR #423 intentionally keeps the managed runtime on the unpinned @agentconnect.md/codex-acp@agentconnect channel; all exact-head GitHub Actions pass and the fast reviewer approved 02b6908, with only the main review-bot still queued. The generic adapter change is also proposed upstream in agentclientprotocol/codex-acp#357. Codex 0.145 source and its permissions profile inheritance test confirm parent-first deep merging of filesystem entries, so the child credential denies do not replace the read-only/workspace base policy.