fix(desktop): load hardened bridge runtime

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 1fc19188-72f7-45c9-9cb3-fc3aad38a17c

Author: SlowGreekMSFT

packages/core/src/copilot-bridge.ts

@@ -390,6 +390,7 @@ function responsesBody(input: RequestInit["body"]) {
     parallel_tool_calls: false,
     input: decoded.input.map((item) => {
       if (!isRecord(item) || item.type !== undefined || typeof item.role !== "string") return item
+      if (item.role === "developer") return { type: "message", ...item, role: "system" }
       return { type: "message", ...item }
     }),
   })

packages/core/src/outbound-audit.ts

@@ -1,9 +1,9 @@
 import { appendFileSync, chmodSync, mkdirSync } from "node:fs"
 import { dirname, join } from "node:path"
-import { Global } from "./global"
+import { xdgState } from "xdg-basedir"
 import type { Audit, AuditEvent } from "./outbound"
 
-export function create(file = join(Global.Path.state, "security", "outbound.jsonl")): Audit {
+export function create(file = join(xdgState!, "opencode", "security", "outbound.jsonl")): Audit {
   mkdirSync(dirname(file), { recursive: true, mode: 0o700 })
   chmodSync(dirname(file), 0o700)
   return (event: AuditEvent) => {
@@ -15,4 +15,4 @@ export function create(file = join(Global.Path.state, "security", "outbound.json
   }
 }
 
-export * as OutboundAudit from "./outbound-audit"
+export * as OutboundAudit from "./outbound-audit.ts"

packages/core/src/outbound.ts

@@ -40,9 +40,11 @@ let installed = false
 
 export class Denied extends Error {
   override readonly name = "OutboundPolicyDenied"
+  readonly reason: AuditReason
 
-  constructor(readonly reason: AuditReason) {
+  constructor(reason: AuditReason) {
     super(`Outbound request denied by workplace policy (${reason})`)
+    this.reason = reason
   }
 }
 
@@ -204,4 +206,4 @@ function redirectRequest(
   })
 }
 
-export * as Outbound from "./outbound"
+export * as Outbound from "./outbound.ts"

packages/core/test/copilot-bridge.test.ts

@@ -110,13 +110,19 @@ describe("CopilotBridge transport", () => {
         store: true,
         previous_response_id: "untrusted",
         conversation: "untrusted",
-        input: [{ role: "user", content: [{ type: "input_text", text: "hello" }] }],
+        input: [
+          { role: "developer", content: "system instructions" },
+          { role: "user", content: [{ type: "input_text", text: "hello" }] },
+        ],
       }),
     })
     expect(body).toEqual({
       store: false,
       parallel_tool_calls: false,
-      input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hello" }] }],
+      input: [
+        { type: "message", role: "system", content: "system instructions" },
+        { type: "message", role: "user", content: [{ type: "input_text", text: "hello" }] },
+      ],
     })
   })