feat: harden boss local v1 runtime

scripts/claude_executor.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+workspace="${BOSS_WORKSPACE:-$PWD}"
+task_title="${BOSS_TASK_TITLE:-Untitled task}"
+task_kind="${BOSS_TASK_KIND:-general}"
+task_description="${BOSS_TASK_DESCRIPTION:-No description provided.}"
+
+if ! command -v claude >/dev/null 2>&1; then
+  echo "claude CLI not found in PATH" >&2
+  exit 1
+fi
+
+cd "$workspace"
+
+prompt=$(cat <<EOF
+You are the device-side execution worker for Boss.
+
+Task title: ${task_title}
+Task kind: ${task_kind}
+Task description:
+${task_description}
+
+Work only inside this workspace:
+${workspace}
+
+Expectations:
+- Make the smallest correct change that moves the task forward.
+- If you modify code, mention validation or remaining risks in the final summary.
+- If the task is research-only, summarize findings and next steps instead of forcing edits.
+EOF
+)
+
+extra_flags=()
+if [[ -n "${BOSS_CLAUDE_FLAGS:-}" ]]; then
+  # shellcheck disable=SC2206
+  extra_flags=(${BOSS_CLAUDE_FLAGS})
+fi
+
+exec claude --print "${extra_flags[@]}" "$prompt"

scripts/codex_executor.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+workspace="${BOSS_WORKSPACE:-$PWD}"
+task_title="${BOSS_TASK_TITLE:-Untitled task}"
+task_kind="${BOSS_TASK_KIND:-general}"
+task_description="${BOSS_TASK_DESCRIPTION:-No description provided.}"
+
+if ! command -v codex >/dev/null 2>&1; then
+  echo "codex CLI not found in PATH" >&2
+  exit 1
+fi
+
+cd "$workspace"
+
+prompt=$(cat <<EOF
+You are the device-side execution worker for Boss.
+
+Task title: ${task_title}
+Task kind: ${task_kind}
+Task description:
+${task_description}
+
+Work only inside this workspace:
+${workspace}
+
+Expectations:
+- Make the smallest correct change that moves the task forward.
+- If you modify code, mention validation or remaining risks in the final summary.
+- If the task is research-only, summarize findings and next steps instead of forcing edits.
+EOF
+)
+
+extra_flags=()
+if [[ -n "${BOSS_CODEX_FLAGS:-}" ]]; then
+  # shellcheck disable=SC2206
+  extra_flags=(${BOSS_CODEX_FLAGS})
+fi
+
+exec codex exec "${extra_flags[@]}" "$prompt"