From 35cdc5d6056501c9323581bf1ade3097bf9c1040 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Fri, 30 Oct 2026 14:11:33 -0700 Subject: [PATCH 1/3] fix(byo): give the Codex listener its folder note (TASK-645 item 6) The Claude Code listener says what it can reach and how --allow widens it. The Codex listener said nothing, so a Codex user could not tell which folder it works in. Code check: firstRunWorkspace returns a folder only for claude, so a Codex seat runs in its scratch folder, and `run --allow` errors for any adapter that has no workspace folder. The Codex note says exactly that and leaves the flag off the command. Test: the Codex listener shows the note after the switch, and the Claude note is gone. Co-Authored-By: Claude Haiku 5.5 Co-authored-by: rivet Agent-Model: claude/claude-haiku-5-5/default --- frontend/src/i18n/locales/en.json | 1 + frontend/src/i18n/locales/zh-CN.json | 1 + frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx | 3 +++ frontend/src/v2/components/V2AgentBYO.tsx | 5 +++++ 4 files changed, 10 insertions(+) diff --git a/frontend/src/i18n/locales/en.json b/frontend/src/i18n/locales/en.json index d33af655a8..3bc421a57c 100644 --- a/frontend/src/i18n/locales/en.json +++ b/frontend/src/i18n/locales/en.json @@ -1708,6 +1708,7 @@ "title": "Run this in Terminal", "note": "MCP alone won't wake {{name}} for @mentions. Keep this Terminal open.", "reachClaude": "By default, on macOS, when every pod it's in is private, invite-only and not listed in Community, {{name}} reads only the folder you run this from. Otherwise, or when you run it from your home folder, it works in its own scratch folder. To let it edit files and run commands, add --allow write to the last line. Those commands can read beyond the folder. To let it fetch web pages, add --allow web. Either one lets it send what it reads off this computer, so grant them only in a pod you trust.", + "reachCodex": "Codex works in its own scratch folder under your temp directory, not the folder you run this from. --allow does not apply to Codex, so the last line has no flag.", "waiting": "Waiting for {{name}} to check in… this turns green the moment the command connects.", "verified": "{{name}} is listening — mentions will wake it.", "stillWaiting": "Still no check-in from {{name}}. Run the command above in Terminal on your computer, and this page will confirm it.", diff --git a/frontend/src/i18n/locales/zh-CN.json b/frontend/src/i18n/locales/zh-CN.json index de522bc6a6..a017000ec1 100644 --- a/frontend/src/i18n/locales/zh-CN.json +++ b/frontend/src/i18n/locales/zh-CN.json @@ -1768,6 +1768,7 @@ "title": "在终端里运行这段命令", "note": "仅连接 MCP 不会唤醒 {{name}} 回复 @提及。请保持终端窗口开启。", "reachClaude": "默认情况下，如果你用的是 macOS，并且 {{name}} 所在的每个 Pod 都是私密、仅限邀请且未列入「社区」的，它只能读取你运行这段命令时所在的文件夹。不满足这些条件，或者你在个人文件夹里运行这段命令，它都会在自己的临时文件夹里工作。想让它编辑文件、运行命令，就在最后一行加上 --allow write。它运行的命令能读取文件夹以外的内容。想让它抓取网页，就加上 --allow web。无论加哪一个，它都能把读到的内容传出这台电脑，所以只在你信任的 Pod 里授予这两项权限。", + "reachCodex": "Codex 在临时文件夹下它自己的暂存文件夹里工作，不在你运行这段命令的文件夹里。--allow 对 Codex 不适用，所以最后一行不加任何参数。", "waiting": "正在等待 {{name}} 接入…命令一接通，这里就会变绿。", "verified": "{{name}} 已在监听 —— @提及 会唤醒它。", "stillWaiting": "{{name}} 还没接入。请在你电脑的终端里运行上面的命令，这里会自动确认。", diff --git a/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx b/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx index 74c9cd221d..00dda3da62 100644 --- a/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx +++ b/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx @@ -217,6 +217,9 @@ describe('BYO listener snippet', () => { test('a Codex listener shows no Claude folder note', async () => { await issueToken('codex'); expect(screen.queryByTestId('byo-listen-reach')).toBeNull(); + // Codex gets its own note: it runs in its scratch folder, and --allow is refused for it. + expect(screen.getByTestId('byo-listen-reach-codex')).toHaveTextContent(/its own scratch folder under your temp directory/); + expect(screen.getByTestId('byo-listen-reach-codex')).toHaveTextContent(/--allow does not apply to Codex/); }); test('the Claude Code MCP line shows for Claude Code only', async () => { diff --git a/frontend/src/v2/components/V2AgentBYO.tsx b/frontend/src/v2/components/V2AgentBYO.tsx index 9bae537b7d..23a699242c 100644 --- a/frontend/src/v2/components/V2AgentBYO.tsx +++ b/frontend/src/v2/components/V2AgentBYO.tsx @@ -1641,6 +1641,11 @@ const V2AgentBYO: React.FC = () => { {t('agentByo.listen.reachClaude', { name: issued.agentName })}

)} + {listenerAvailable && listenAdapter === 'codex' && ( +

+ {t('agentByo.listen.reachCodex')} +

+ )}

{t('agentByo.result.keyOnce')}

From c28f5b65b82b5a03e067c5fb954b8ce29c525b81 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Fri, 30 Oct 2026 16:14:20 -0700 Subject: [PATCH 2/3] fix(byo): zh-CN Codex folder note, two-pass wording (TASK-645 item 6) Co-Authored-By: Claude Haiku 5.5 Co-authored-by: rivet Agent-Model: claude/claude-haiku-5-5/default --- frontend/src/i18n/locales/zh-CN.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/i18n/locales/zh-CN.json b/frontend/src/i18n/locales/zh-CN.json index a017000ec1..1a9dc650e1 100644 --- a/frontend/src/i18n/locales/zh-CN.json +++ b/frontend/src/i18n/locales/zh-CN.json @@ -1768,7 +1768,7 @@ "title": "在终端里运行这段命令", "note": "仅连接 MCP 不会唤醒 {{name}} 回复 @提及。请保持终端窗口开启。", "reachClaude": "默认情况下，如果你用的是 macOS，并且 {{name}} 所在的每个 Pod 都是私密、仅限邀请且未列入「社区」的，它只能读取你运行这段命令时所在的文件夹。不满足这些条件，或者你在个人文件夹里运行这段命令，它都会在自己的临时文件夹里工作。想让它编辑文件、运行命令，就在最后一行加上 --allow write。它运行的命令能读取文件夹以外的内容。想让它抓取网页，就加上 --allow web。无论加哪一个，它都能把读到的内容传出这台电脑，所以只在你信任的 Pod 里授予这两项权限。", - "reachCodex": "Codex 在临时文件夹下它自己的暂存文件夹里工作，不在你运行这段命令的文件夹里。--allow 对 Codex 不适用，所以最后一行不加任何参数。", + "reachCodex": "Codex 会在系统临时目录里用自己的暂存文件夹工作，不在你运行命令的这个文件夹。--allow 对 Codex 无效，所以最后一行不带参数。", "waiting": "正在等待 {{name}} 接入…命令一接通，这里就会变绿。", "verified": "{{name}} 已在监听 —— @提及 会唤醒它。", "stillWaiting": "{{name}} 还没接入。请在你电脑的终端里运行上面的命令，这里会自动确认。", From 3cf7c1a8fc16d94aea394c566a301f878471dceb Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Fri, 30 Oct 2026 16:46:08 -0700 Subject: [PATCH 3/3] fix(byo): fix Codex reach note wording and pin its render gates The Codex folder note said the last line has no flag under a command that carries --adapter codex. Say no --allow instead (en and zh-CN). Pin the render gates: the Claude listener, Linux-with-Codex and Codex-on-Windows tests now assert the Codex note is absent, so dropping listenAdapter === 'codex' or listenerAvailable goes red. Co-Authored-By: Claude Haiku 5.5 Co-authored-by: rivet Agent-Model: claude/claude-haiku-5-5/default --- frontend/src/i18n/locales/en.json | 2 +- frontend/src/i18n/locales/zh-CN.json | 2 +- frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx | 5 ++++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/frontend/src/i18n/locales/en.json b/frontend/src/i18n/locales/en.json index 3bc421a57c..2759179689 100644 --- a/frontend/src/i18n/locales/en.json +++ b/frontend/src/i18n/locales/en.json @@ -1708,7 +1708,7 @@ "title": "Run this in Terminal", "note": "MCP alone won't wake {{name}} for @mentions. Keep this Terminal open.", "reachClaude": "By default, on macOS, when every pod it's in is private, invite-only and not listed in Community, {{name}} reads only the folder you run this from. Otherwise, or when you run it from your home folder, it works in its own scratch folder. To let it edit files and run commands, add --allow write to the last line. Those commands can read beyond the folder. To let it fetch web pages, add --allow web. Either one lets it send what it reads off this computer, so grant them only in a pod you trust.", - "reachCodex": "Codex works in its own scratch folder under your temp directory, not the folder you run this from. --allow does not apply to Codex, so the last line has no flag.", + "reachCodex": "Codex works in its own scratch folder under your temp directory, not the folder you run this from. --allow does not apply to Codex, so the last line has no --allow.", "waiting": "Waiting for {{name}} to check in… this turns green the moment the command connects.", "verified": "{{name}} is listening — mentions will wake it.", "stillWaiting": "Still no check-in from {{name}}. Run the command above in Terminal on your computer, and this page will confirm it.", diff --git a/frontend/src/i18n/locales/zh-CN.json b/frontend/src/i18n/locales/zh-CN.json index 1a9dc650e1..d86bf219b6 100644 --- a/frontend/src/i18n/locales/zh-CN.json +++ b/frontend/src/i18n/locales/zh-CN.json @@ -1768,7 +1768,7 @@ "title": "在终端里运行这段命令", "note": "仅连接 MCP 不会唤醒 {{name}} 回复 @提及。请保持终端窗口开启。", "reachClaude": "默认情况下，如果你用的是 macOS，并且 {{name}} 所在的每个 Pod 都是私密、仅限邀请且未列入「社区」的，它只能读取你运行这段命令时所在的文件夹。不满足这些条件，或者你在个人文件夹里运行这段命令，它都会在自己的临时文件夹里工作。想让它编辑文件、运行命令，就在最后一行加上 --allow write。它运行的命令能读取文件夹以外的内容。想让它抓取网页，就加上 --allow web。无论加哪一个，它都能把读到的内容传出这台电脑，所以只在你信任的 Pod 里授予这两项权限。", - "reachCodex": "Codex 会在系统临时目录里用自己的暂存文件夹工作，不在你运行命令的这个文件夹。--allow 对 Codex 无效，所以最后一行不带参数。", + "reachCodex": "Codex 会在系统临时目录里用自己的暂存文件夹工作，不在你运行命令的这个文件夹。--allow 对 Codex 无效，所以最后一行不带 --allow。", "waiting": "正在等待 {{name}} 接入…命令一接通，这里就会变绿。", "verified": "{{name}} 已在监听 —— @提及 会唤醒它。", "stillWaiting": "{{name}} 还没接入。请在你电脑的终端里运行上面的命令，这里会自动确认。", diff --git a/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx b/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx index 00dda3da62..9733f652b8 100644 --- a/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx +++ b/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx @@ -204,9 +204,10 @@ describe('BYO listener snippet', () => { expect(axios.delete).not.toHaveBeenCalled(); }); - test('a Claude Code listener says what it can reach and how --allow widens it; Codex says nothing of folders', async () => { + test('a Claude Code listener says what it can reach and how --allow widens it; Codex gets its own note only', async () => { await issueToken(); const reach = screen.getByTestId('byo-listen-reach'); + expect(screen.queryByTestId('byo-listen-reach-codex')).toBeNull(); expect(reach).toHaveTextContent(/By default, on macOS, when every pod it's in is private, invite-only and not listed in Community, .+ reads only the folder you run this from\. Otherwise, or when you run it from your home folder, it works in its own scratch folder\./); // The folder bound is the default only: write's commands read past it. expect(reach).toHaveTextContent(/add --allow write to the last line\. Those commands can read beyond the folder\./); @@ -330,6 +331,7 @@ describe('BYO listener snippet', () => { expect(listener()).toBeUndefined(); expect(screen.getByTestId('byo-listen-unavailable')).toHaveTextContent(/The Codex CLI can’t answer @mentions from Linux yet\. .*Linux is not tested yet\./); expect(screen.queryByTestId('byo-listen-npm-hint')).toBeNull(); + expect(screen.queryByTestId('byo-listen-reach-codex')).toBeNull(); }); test('Codex on Windows says so, and offers hosted or another machine', async () => { @@ -339,6 +341,7 @@ describe('BYO listener snippet', () => { expect(screen.getByTestId('byo-listen-unavailable')) .toHaveTextContent(/The Codex CLI can’t answer @mentions from Windows yet\. Choose “Run it here”/); expect(screen.queryByTestId('byo-listen-npm-hint')).toBeNull(); + expect(screen.queryByTestId('byo-listen-reach-codex')).toBeNull(); expect(screen.queryByTestId('byo-mcp-claude')).toBeNull(); });