Security

Web Workspace

The Web server is loopback-only, with per-launch capability checks, Host/Origin validation, bounded request bodies, and allow-listed actions. The capability is not multi-user authentication. Do not expose the service through a proxy or tunnel without a separate security boundary.

Agent executables and wrappers are trusted local programs with their configured permissions. HTTP project binding does not sandbox an agent's shell or prevent filesystem edits. CLI login and provider configuration remain independent; local coordination does not imply offline model inference or credential isolation.

Each Web task uses its project's working directory. New terminal pairs do not create isolated worktrees. Role prompts require user authorization for commit, push, and release, but provide no technically enforced release gate. Formal DONE/APPROVED receipts are agent reports, not independent verification.

Browser close or Web server shutdown is not a terminal-close action. Use the explicit close controls to stop owned agent Sessions. Archive closes terminals and hides history while preserving source files; clearing archived conversations permanently deletes their stored task and timeline history.

Project/task records, prompt snapshots, timeline pages, Session data, and the project registry are local plaintext. Git exclusion is not encryption. Agent providers may receive prompts/code under their own configuration. Notification text excludes prompts, terminal output, receipt summaries, and absolute paths, but OS display policy and other local processes remain outside Workspace control.

Inspect and redact diagnostics before sharing. See the Workspace guide for storage paths and lifecycle details.

Shared Session Runtime and structured workflow

The remaining Task, Task Graph, Agent Bus, adapter, and installer guarantees apply to their corresponding source/Plugin or Legacy APIs. They must not be inferred from Web task receipts. For entry points see Structured workflow.

.agent-bus is local plaintext working data, including the append-only Event Journal under .agent-bus/events/. It is not encrypted and must not contain tokens, cookies, passwords, private keys, or unnecessary production data.

Execution Session metadata is bounded and excludes environment variables. Session endpoints are derived from the validated repository root and Session ID; input is structured text, not a shell string; and the Session Host can interrupt or terminate only the process it created. The Runtime does not attach to arbitrary PIDs or automate the Codex App Terminal UI. The preferred node-pty backend may use a bounded owned-stdio compatibility backend when a direct Plugin checkout has no installed package dependencies.

Task Graph v1 validation is read-only and precedes Git discovery, Bus handoff, Adapter resolution, worktree or Session creation, and child-process spawn. Invalid DAGs return the bounded TASK_GRAPH_INVALID Runtime error without initializing .agent-bus or persisting graph state. The separate graph-create operation persists only an already validated graph record and its append-only lifecycle event; it does not launch an Adapter, Session, or Implementer process. An optional Intent Map v1 companion is size-bounded and normalized before that boundary. Unknown, missing, or duplicate subtask coverage; duplicate patterns; absolute, drive-relative, escaping, or control-bearing paths; unsupported policies; and contradictory durable map facts fail closed. Write-intent patterns are structured data and are never evaluated through a shell. Graph planning reports deterministic dependency, capacity, and exact configured Agent/Adapter/executable facts without creating a worktree, Bus message, Session, lifecycle event, or child process. When Intent Map coverage exists, literal prefix mismatches prove separation and all unresolved glob relationships are treated conservatively. The later READY item is deferred with a bounded WRITE_INTENT_CONFLICT fact. Dispatch repeats the same compatibility check against RUNNING items under the graph lock before any worktree, Session, or process launch. No dependency edge is added, patterns are never executed through a shell, and declaration-based scheduling is not diff audit. The graph-dispatch operation captures one exact base commit and uses only a Runtime-owned, repository-contained, non-symlinked worktree and branch for the selected READY subtask. Its persistent Session is rooted at that worktree; exact Adapter command precedence, bounded I/O, and non-zero exit semantics remain in force. Launch or completion failures do not trigger automatic retry/fallback or mutate unrelated subtasks, and dispatch never changes the user's checkout. Parallel graph execution claims READY subtasks under the graph lock, atomically enforces the persisted concurrency limit, and gives every selected subtask a distinct worktree, branch/ref, message, and Session identity rooted at one exact graph base commit. Failures remain isolated and never trigger fallback or automatic retry. Bounded graph advance requires an explicit 1–32 wave limit, reads a fresh Preflight before each wave, and stops on conflicts, non-success, recovery state, integration failure, or requested changes. It never invokes recovery, retries, changes dependencies, integrates, reviews, or authorizes release. Graph recovery is facts-first: status and inspect expose durable Session/worktree/commit/evidence classifications, and recovery only promotes a verified IMPLEMENTATION_DONE commit or records an interrupted FAILED state. Explicit resume reuses a verified healthy Runtime-owned Session/worktree and otherwise returns READY for a separate dispatch; it never loops or infers success from filenames or prose. Explicit graph stop/cleanup close only matching Runtime-owned Sessions and remove only the exact Runtime-owned worktree after a bounded timeout. Ownership mismatches, symlinks, path escapes, and cleanup failures are preserved as durable bounded errors; branches, refs, commits, evidence, and the user's worktree remain intact. Graph integration is a separate, explicit boundary. It runs only after every required subtask has verified completion evidence, checks the exact Runtime source refs and captured base commit, and applies commits in deterministic order inside a distinct Runtime-owned aggregate worktree. It never changes the current checkout or source worktrees. A cherry-pick conflict remains in place with bounded source, applied-ref, Git-status, and conflict facts for inspection; no automatic resolution, reset, retry, merge, push, tag, publish, deploy, or release occurs. Aggregate review rechecks those facts before recording REVIEW_APPROVED or CHANGES_REQUESTED, and cleanup retains the aggregate branch, commits, conflict facts, and evidence.

Local Git exclusion prevents ordinary commits but does not block administrators, same-user processes, backups, cloud sync, or malware. Inspect and redact bus data before sharing diagnostics. For the Legacy runtime only, clean --confirm DELETE_AGENT_BUS is an explicit destructive operation after audit retention is no longer needed. It is not a Web uninstall step.

The installer refuses unknown directories, symlinks, junctions, path escapes, modified installs, and extra files by default. Review the full security policy, including private vulnerability reporting.