From 442cde8d99993cd4962fc5dffc02ba72b3bb2576 Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Tue, 14 Jul 2026 23:26:26 -0700
Subject: [PATCH] fix(codex): resolve grant entry from __dirname so plain-node
 CLI entries stay electron-free

The build guard rejects any electron require reachable from plain-node
entries; the bridge now maps app.asar to app.asar.unpacked by string
replacement instead of consulting electron app paths. CLI typecheck project
lists the new trust-grant module graph.
---
 config/tsconfig.cli.json                      |  8 +++----
 .../codex/codex-app-server-grant-bridge.ts    | 24 +++++++++----------
 2 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/config/tsconfig.cli.json b/config/tsconfig.cli.json
index 67b0c33fda8..81792bba35e 100644
--- a/config/tsconfig.cli.json
+++ b/config/tsconfig.cli.json
@@ -11,14 +11,14 @@
     "../src/main/antigravity/hook-service.ts",
     "../src/main/claude/hook-settings.ts",
     "../src/main/claude/hook-service.ts",
-    "../src/main/codex/codex-config-mirror.ts",
-    "../src/main/codex/codex-config-path-reference-rewrite.ts",
-    "../src/main/codex/codex-home-paths.ts",
-    "../src/main/codex/codex-hook-identity.ts",
     "../src/main/codex/codex-app-server-capability-cache.ts",
     "../src/main/codex/codex-app-server-client.ts",
     "../src/main/codex/codex-app-server-grant-bridge.ts",
     "../src/main/codex/codex-app-server-grant-envelope.ts",
+    "../src/main/codex/codex-config-mirror.ts",
+    "../src/main/codex/codex-config-path-reference-rewrite.ts",
+    "../src/main/codex/codex-home-paths.ts",
+    "../src/main/codex/codex-hook-identity.ts",
     "../src/main/codex/codex-hook-trust-grant.ts",
     "../src/main/codex/codex-trust-config-rollback.ts",
     "../src/main/codex/codex-trust-grant-ledger.ts",
diff --git a/src/main/codex/codex-app-server-grant-bridge.ts b/src/main/codex/codex-app-server-grant-bridge.ts
index 1c960e15129..a42c2a3b7ac 100644
--- a/src/main/codex/codex-app-server-grant-bridge.ts
+++ b/src/main/codex/codex-app-server-grant-bridge.ts
@@ -24,19 +24,17 @@ const GRANT_ENTRY_MAX_BUFFER_BYTES = 16 * 1024 * 1024
 export function resolveCodexGrantEntryPath(
   pathExists: (candidate: string) => boolean = existsSync
 ): string | null {
-  // Why: this module is also bundled into a plain-Node CLI entry, so entry
-  // discovery cannot import Electron. Replacing the module's own asar segment
-  // finds the unpacked sibling in packaged builds and is a no-op in dev.
-  const unpackedModuleDir = __dirname.replace('app.asar', 'app.asar.unpacked')
-  const resourcesPath = (process as NodeJS.Process & { resourcesPath?: string }).resourcesPath
-  const candidates = [
-    resourcesPath
-      ? join(resourcesPath, 'app.asar.unpacked', 'out', 'main', 'codex', GRANT_ENTRY_FILE_NAME)
-      : null,
-    join(unpackedModuleDir, 'codex', GRANT_ENTRY_FILE_NAME),
-    join(unpackedModuleDir, '..', 'codex', GRANT_ENTRY_FILE_NAME)
-  ].filter((candidate): candidate is string => candidate !== null)
-  for (const candidate of candidates) {
+  // Why: resolved from __dirname (not electron's app paths) so this module
+  // stays loadable in plain-node CLI entries — the build guard rejects any
+  // electron require reachable from them. The emitted bridge chunk sits in
+  // out/main or out/main/chunks, so the entry is one or two levels up.
+  // ELECTRON_RUN_AS_NODE bypasses asar integration, so packaged builds must
+  // run the copy under app.asar.unpacked (out/main/codex/** is asarUnpacked).
+  const baseDirs = [__dirname, join(__dirname, '..')].map((dir) =>
+    dir.includes('app.asar') ? dir.replace('app.asar', 'app.asar.unpacked') : dir
+  )
+  for (const baseDir of baseDirs) {
+    const candidate = join(baseDir, 'codex', GRANT_ENTRY_FILE_NAME)
     if (pathExists(candidate)) {
       return candidate
     }