@aiwg/cli 2026.10.4 → 2026.10.6

package/dist/src/models/model-capabilities.v1.json

@@ -53,7 +53,8 @@
           "cwd": "${workspace}",
           "envAllowlist": [
             "GEMINI_API_KEY",
-            "HOME"
+            "HOME",
+            "PATH"
           ],
           "versionArgv": [
             "--version"
@@ -144,7 +145,8 @@
             },
             "envAllowlist": [
               "GEMINI_API_KEY",
-              "HOME"
+              "HOME",
+              "PATH"
             ],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification.",
@@ -516,7 +518,8 @@
           "cwd": "${workspace}",
           "envAllowlist": [
             "CODEX_HOME",
-            "HOME"
+            "HOME",
+            "PATH"
           ],
           "versionPattern": "^codex-cli ([0-9A-Za-z.+-]{1,128})$",
           "versionArgv": [
@@ -608,7 +611,8 @@
             },
             "envAllowlist": [
               "CODEX_HOME",
-              "HOME"
+              "HOME",
+              "PATH"
             ],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification.",
@@ -721,7 +725,7 @@
           ],
           "stdin": "closed",
           "cwd": "${workspace}",
-          "envAllowlist": [],
+          "envAllowlist": ["PATH"],
           "versionArgv": [
             "--version"
           ],
@@ -809,7 +813,7 @@
                 "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--auto-tier <preference> Set the Auto routing profile')"
               }
             },
-            "envAllowlist": [],
+            "envAllowlist": ["PATH"],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification.",
               "Unknown model, effort, permission or required step mappings block dispatch.",
@@ -904,7 +908,8 @@
           "cwd": "${workspace}",
           "envAllowlist": [
             "CURSOR_API_KEY",
-            "HOME"
+            "HOME",
+            "PATH"
           ],
           "versionPattern": "^([0-9A-Za-z.+-]{1,128})$",
           "versionArgv": [
@@ -996,7 +1001,8 @@
             },
             "envAllowlist": [
               "CURSOR_API_KEY",
-              "HOME"
+              "HOME",
+              "PATH"
             ],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification.",
@@ -1110,7 +1116,7 @@
           ],
           "stdin": "brief-text",
           "cwd": "${workspace}",
-          "envAllowlist": ["FACTORY_API_KEY", "HOME"],
+          "envAllowlist": ["FACTORY_API_KEY", "HOME", "PATH"],
           "versionArgv": [
             "--version"
           ],
@@ -1198,7 +1204,7 @@
                 "evidence": "H: droid-cli 0.238.0 exec --help scopes --spec-model/--worker-model/--validator-model to --mission/--use-spec; unknown controls block tasks requiring them"
               }
             },
-            "envAllowlist": ["FACTORY_API_KEY", "HOME"],
+            "envAllowlist": ["FACTORY_API_KEY", "HOME", "PATH"],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification.",
               "Unknown model, effort, permission or required step mappings block dispatch.",
@@ -1314,7 +1320,7 @@
           ],
           "stdin": "closed",
           "cwd": "${workspace}",
-          "envAllowlist": [],
+          "envAllowlist": ["PATH"],
           "versionArgv": [
             "--version"
           ],
@@ -1402,7 +1408,7 @@
                 "evidence": "H: opencode 2.0.26 `opencode run --help`"
               }
             },
-            "envAllowlist": [],
+            "envAllowlist": ["PATH"],
             "pitfalls": [
               "Stdin is confirmed unsupported (conductor disassembly of the installed opencode 2.0.26 binary: no stdin/isTTY handling in the compiled 'run' chunk, host 'noodle', 2026-10-09). The brief travels as an attached file via -f/--file; the positional argv message is a fixed, content-free instruction and never carries brief text.",
               "There is no positive session-terminal JSON event in any compatibility mode: binary disassembly shows the run loop returns silently on session.execution.succeeded. A live 2.0.26 smoke run (one complete `text` event, nothing else) confirms this is a genuine success shape, not truncation; parseOutput accepts a complete text part OR a step_finish reason \"stop\" as the positive signal, never exit code alone.",
@@ -1501,7 +1507,8 @@
           "stdin": "closed",
           "cwd": "${workspace}",
           "envAllowlist": [
-            "WARP_API_KEY"
+            "WARP_API_KEY",
+            "PATH"
           ],
           "versionArgv": [
             "--version"
@@ -1591,7 +1598,8 @@
               }
             },
             "envAllowlist": [
-              "WARP_API_KEY"
+              "WARP_API_KEY",
+              "PATH"
             ],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification; the host used for probes (noodle) has no `warp-terminal login`/`WARP_API_KEY`, so every probe stopped at the auth check and never reached a model.",
@@ -1716,7 +1724,7 @@
           ],
           "stdin": "brief-text",
           "cwd": "${workspace}",
-          "envAllowlist": [],
+          "envAllowlist": ["PATH"],
           "versionArgv": [
             "--version"
           ],
@@ -1804,7 +1812,7 @@
                 "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10) documents a single --model flag with no fallback list"
               }
             },
-            "envAllowlist": [],
+            "envAllowlist": ["PATH"],
             "pitfalls": [
               "--approval-mode is never omitted: the installed binary's compiled-in default is yolo (a full bypass), so an omitted flag is the most dangerous outcome, not a safe one.",
               "--approval-mode is fixed to write; always-ask (prompts for write AND exec) and yolo (bypasses everything) are never rendered. write only auto-approves read/write-tier tools; an exec-tier tool (bash) still resolves to a required-approval decision with no confirmed headless resolution -- an open S1 gap.",
@@ -1928,7 +1936,7 @@
           ],
           "stdin": "brief-text",
           "cwd": "${workspace}",
-          "envAllowlist": [],
+          "envAllowlist": ["PATH"],
           "versionArgv": [
             "--version"
           ],
@@ -2016,7 +2024,7 @@
                 "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) documents a single --model flag with no fallback list"
               }
             },
-            "envAllowlist": [],
+            "envAllowlist": ["PATH"],
             "pitfalls": [
               "--no-approve alone does not stop context loading: ancestor AGENTS.md/CLAUDE.md load independently of trust unless --no-context-files is also set (R: installed bundle chunk-OIM2DMFI.js). --no-context-files, --no-extensions, --no-skills and --no-mcp (1.1.0 adds built-in MCP support, on by default) are always rendered alongside it.",
               "--approve is never rendered, which would trust arbitrary project-local extension/config files.",
@@ -2124,7 +2132,8 @@
           "stdin": "brief-text",
           "cwd": "${workspace}",
           "envAllowlist": [
-            "DEEPSEEK_API_KEY"
+            "DEEPSEEK_API_KEY",
+            "PATH"
           ],
           "versionArgv": [
             "--version"
@@ -2214,7 +2223,8 @@
               }
             },
             "envAllowlist": [
-              "DEEPSEEK_API_KEY"
+              "DEEPSEEK_API_KEY",
+              "PATH"
             ],
             "pitfalls": [
               "buildWorkerArgs emits ${artifact:dsh-patch}; buildWorkerArtifacts declares the pure overlay. The launcher owns exclusive/no-follow private file creation and cleanup. Controls remain unqualified pending an authenticated run.",
@@ -2346,7 +2356,8 @@
           "stdin": "closed",
           "cwd": "${workspace}",
           "envAllowlist": [
-            "OPENROUTER_API_KEY"
+            "OPENROUTER_API_KEY",
+            "PATH"
           ],
           "versionArgv": [
             "--version"
@@ -2436,7 +2447,8 @@
               }
             },
             "envAllowlist": [
-              "OPENROUTER_API_KEY"
+              "OPENROUTER_API_KEY",
+              "PATH"
             ],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification.",
@@ -2574,7 +2586,8 @@
           "cwd": "${workspace}",
           "envAllowlist": [
             "XAI_API_KEY",
-            "HOME"
+            "HOME",
+            "PATH"
           ],
           "versionArgv": [
             "--version"
@@ -2666,7 +2679,8 @@
             },
             "envAllowlist": [
               "XAI_API_KEY",
-              "HOME"
+              "HOME",
+              "PATH"
             ],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification.",
@@ -2767,7 +2781,7 @@
           ],
           "stdin": "brief-text",
           "cwd": "${workspace}",
-          "envAllowlist": [],
+          "envAllowlist": ["PATH"],
           "versionPattern": "^Hermes Agent v([0-9A-Za-z.+-]{1,128}) [^\\r\\n]{1,128}$",
           "versionArgv": [
             "--version"
@@ -2812,7 +2826,7 @@
               },
               "approval": {
                 "support": "unqualified",
-                "mapping": "--ignore-user-config always emitted: falls back to the safe built-in defaults (approvals.mode: \"smart\", approvals.single_query_mode: \"deny\"; config_defaults.py:1679,1682) regardless of the host's config.yaml, defeating single_query_mode: approve/off/allow/yes (approval_context.py:298-304,313-315) and approvals.mode: off (approval.py:967). HERMES_YOLO_MODE is a process env var frozen at import (approval.py:46); defeated structurally by the empty envAllowlist and env -i renderer, not by a flag, and proven by an explicit assertion (HD10). Re-verified against hermes 0.21.6 (~/.hermes/hermes-agent): same semantics, refactored into tools/approval_context.py's _binary_approval_mode helper.",
+                "mapping": "--ignore-user-config always emitted: falls back to the safe built-in defaults (approvals.mode: \"smart\", approvals.single_query_mode: \"deny\"; config_defaults.py:1679,1682) regardless of the host's config.yaml, defeating single_query_mode: approve/off/allow/yes (approval_context.py:298-304,313-315) and approvals.mode: off (approval.py:967). HERMES_YOLO_MODE is a process env var frozen at import (approval.py:46); defeated structurally by the PATH-only envAllowlist and env -i renderer, not by a flag, and proven by an explicit assertion (HD10). Re-verified against hermes 0.21.6 (~/.hermes/hermes-agent): same semantics, refactored into tools/approval_context.py's _binary_approval_mode helper.",
                 "evidence": "D: hermes 0.21.6 installed source (~/.hermes/hermes-agent: tools/approval.py:46,967; tools/approval_context.py:298-304,313-315; hermes_cli/config_defaults.py:1679,1682); never live-qualified"
               },
               "workdir": {
@@ -2852,21 +2866,21 @@
               },
               "fallback": {
                 "support": "unqualified",
-                "mapping": "--provider PROVIDER pins the inference provider for this call; always emitted by this profile (never omitted) because --ignore-user-config removes the config.yaml provider fallback and the empty envAllowlist removes the HERMES_INFERENCE_PROVIDER fallback, so an omitted --provider resolves to the literal \"auto\" (resolve_requested_provider, runtime_provider.py:490-499) and silently picks whatever ambient credential Hermes finds; hermes fallback/moa subcommands configure persistent chains, not a per-call override",
+                "mapping": "--provider PROVIDER pins the inference provider for this call; always emitted by this profile (never omitted) because --ignore-user-config removes the config.yaml provider fallback and the PATH-only envAllowlist removes the HERMES_INFERENCE_PROVIDER fallback, so an omitted --provider resolves to the literal \"auto\" (resolve_requested_provider, runtime_provider.py:490-499) and silently picks whatever ambient credential Hermes finds; hermes fallback/moa subcommands configure persistent chains, not a per-call override",
                 "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation); confirmed by TWO live conductor smoke runs: 0.20.6 on 2026-10-09 (omitted --provider failed with \"No inference provider configured\" under --ignore-user-config) and 0.21.6 on 2026-10-10 (`--provider openrouter -m anthropic/claude-sonnet-4.6 --reasoning low` exited 0 with the exact instructed stdout) — still unqualified pending a repeatable, authorized live-qualification pass"
               }
             },
-            "envAllowlist": [],
+            "envAllowlist": ["PATH"],
             "pitfalls": [
               "Documentation/help and installed-source reading are not authenticated live qualification.",
               "This profile deliberately does NOT use the top-level -z/--oneshot PROMPT path: that dest is argv-only (no stdin/file option) and oneshot.py unconditionally sets HERMES_YOLO_MODE=1 with no override, and its exit code can be 0 even when its own usage-file failed flag is true.",
               "Exit code 0 alone is still not treated as completion evidence by this profile, even though hermes 0.21.6 fixed the specific 0.20.6 bug this guarded against: on 0.20.6, reasoning-budget exhaustion (then agent/conversation_loop.py:3902) returned completed:false/partial:true with no \"failed\" key and still exited 0; on 0.21.6 the same case (now agent/turn_truncation.py:95-180's partial_result()) correctly exits 1 via _single_query_exit_code (cli_single_query.py:152-194). parseWorkerFinal keeps requiring a strict workerClaims JSON parse in addition to the exit-derived status, now as defense in depth against a completed turn whose model output simply isn't valid JSON.",
               "Approval policy is host config (approvals.mode, approvals.single_query_mode in config.yaml), not an argv flag; --ignore-user-config pins it to the safe built-in defaults, but this is read from source, not live-qualified, so the approval control stays unqualified.",
-              "HERMES_YOLO_MODE (and any HERMES_* override) must never reach the worker process; this relies on the empty envAllowlist and the renderer's env -i, not on a CLI flag.",
+              "HERMES_YOLO_MODE (and any HERMES_* override) must never reach the worker process; this relies on the PATH-only envAllowlist and the renderer's env -i, not on a CLI flag.",
               "chat --query-file - --oneshot --quiet has no --usage-file/JSON-report equivalent; final-output extraction is stdout-text-on-exit-0 PLUS a strict workerClaims parse, never exit code or stdout non-emptiness alone.",
               "A partial response can still print to stdout before a failed turn; only the exit code (not stdout non-emptiness) distinguishes that case from success, and even exit 0 is not sufficient (see above).",
               "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
-              "--provider defaults to \"auto\" (hermes_cli/runtime_provider.py:490-499) when omitted; under --ignore-user-config and the empty envAllowlist both of its fallbacks (config.yaml model.provider, HERMES_INFERENCE_PROVIDER) are unreachable, so this profile always emits an explicit --provider from the resolved selection and refuses a missing value or the literal \"auto\". Confirmed by live smoke runs on both 0.20.6 (failure) and 0.21.6 (success with --provider openrouter).",
+              "--provider defaults to \"auto\" (hermes_cli/runtime_provider.py:490-499) when omitted; under --ignore-user-config and the PATH-only envAllowlist both of its fallbacks (config.yaml model.provider, HERMES_INFERENCE_PROVIDER) are unreachable, so this profile always emits an explicit --provider from the resolved selection and refuses a missing value or the literal \"auto\". Confirmed by live smoke runs on both 0.20.6 (failure) and 0.21.6 (success with --provider openrouter).",
               "On hermes 0.20.6, --quiet --oneshot could still print a startup diagnostic to stdout before the final response (that build's _ensure_tirith_security, the tirith-scanner-unavailable warning). On hermes 0.21.6 the tirith scanner was removed entirely (hermes_cli/config_migrations.py:686-702, \"the bundled tirith scanner left Hermes\") and a 2026-10-10 conductor smoke run on 0.21.6 confirmed the line no longer appears; a broader source grep across ~/.hermes/hermes-agent found no other bare-\"⚠\" _cprint site reachable from this profile's --quiet dispatch. parseWorkerFinal still strips that exact leading diagnostic shape as defensive, forward-compatible tolerance (harmless no-op on 0.21.6), and still fails on unrecognized preamble or a diagnostic appearing after the real final."
             ],
             "health": {
@@ -2949,7 +2963,7 @@
           ],
           "stdin": "brief-json",
           "cwd": "${workspace}",
-          "envAllowlist": [],
+          "envAllowlist": ["PATH"],
           "versionArgv": [
             "--help"
           ],
@@ -3037,7 +3051,7 @@
                 "evidence": "D: openhuman-core 0.64.14 source @216ea32; live qualification required"
               }
             },
-            "envAllowlist": [],
+            "envAllowlist": ["PATH"],
             "pitfalls": [
               "Documentation/help and synthetic observations are not authenticated live qualification.",
               "Unknown model, effort, permission or required step mappings block dispatch.",
@@ -3120,7 +3134,7 @@
         "provider": "muse",
         "adapterVersion": "1",
         "supportedVersions": ">=1.4.4-R5419.1 <2.0.0",
-        "runtimeDriver": "tools/ralph-external/lib/muse-adapter.mjs",
+        "runtimeDriver": "installed:muse",
         "catalogAdapter": {
           "kind": "file",
           "locator": "agentic/code/providers/model-catalog.v1.json",
@@ -3153,7 +3167,10 @@
           ],
           "stdin": "closed",
           "cwd": "${workspace}",
-          "envAllowlist": [],
+          "envAllowlist": [
+            "HOME",
+            "PATH"
+          ],
           "versionPattern": "^Muse Code ([0-9A-Za-z.+-]{1,128}) \\([0-9A-Za-z.+-]{1,128}\\)$",
           "versionArgv": [
             "--version"
@@ -3161,13 +3178,14 @@
           "maxOutputBytes": 10485760
         },
         "capabilities": {
-          "output": "native-schema",
+          "output": "text",
           "modelPin": "requested",
           "effort": "explicit",
           "cancel": "none",
           "resume": false,
           "sandboxModes": [
-            "external"
+            "read-only",
+            "workspace-write"
           ],
           "nestedAgentsControllable": false,
           "nativeFallbackControllable": false,
@@ -3184,52 +3202,52 @@
               "model": {
                 "support": "unqualified",
                 "mapping": "--model",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "effort": {
                 "support": "unqualified",
                 "mapping": "--reasoning-effort",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "sandbox": {
                 "support": "unqualified",
-                "mapping": "qualified external boundary; native sandbox remains enabled",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "mapping": "native sandbox enabled; read-only adds --disable-write and --disable-shell",
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "approval": {
                 "support": "unqualified",
                 "mapping": "[\"--approval-mode\",\"never\",\"--approval-judge\",\"off\"]",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "workdir": {
                 "support": "unqualified",
                 "mapping": "--workspace",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "finalOutput": {
                 "support": "unqualified",
                 "mapping": "bounded stdout capture; strict Muse terminal normalization pending shared owner",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "stdin": {
                 "support": "unqualified",
                 "mapping": "closed EOF",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "structuredOutput": {
                 "support": "unqualified",
-                "mapping": "--output-schema",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "mapping": "[]",
+                "evidence": "Direct Tier 0 output is text; structured output requires a host-bound schema and separate qualification."
               },
               "stepCap": {
                 "support": "unqualified",
                 "mapping": "--max-model-steps",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "trust": {
                 "support": "unqualified",
                 "mapping": "[]",
-                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
               },
               "children": {
                 "support": "unqualified",
@@ -3242,7 +3260,10 @@
                 "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
               }
             },
-            "envAllowlist": [],
+            "envAllowlist": [
+              "HOME",
+              "PATH"
+            ],
             "pitfalls": [
               "Live qualification is an open S1 blocker; installed help and synthetic/echo mechanics are not paid inference qualification.",
               "Configured-model events provide runtime-configured identity only, never backend attestation.",
@@ -3251,7 +3272,10 @@
               "Host qualification must bind an absolute output-schema mapping and include that schema in runtimeFiles.",
               "Muse JSONL strict normalization needs the shared strict-parser hook; the MCP bridge must consume the selected provider parser. MSP is not MCP.",
               "Semantic step/tool completion grammar and native session-log layout remain unavailable; unrelated logs, deltas and CPU cannot establish progress.",
-              "Shared version gate: installation requires the raw trimmed banner Muse Code 1.4.4 (1.4.4-R5419.1), but semver selection requires 1.4.4-R5419.1. No normalization exists; keep unqualified until the shared owner binds raw and normalized versions."
+              "Shared version gate: installation requires the raw trimmed banner Muse Code 1.4.4 (1.4.4-R5419.1), but semver selection requires 1.4.4-R5419.1. No normalization exists; keep unqualified until the shared owner binds raw and normalized versions.",
+              "Operator qualification approves the installed direct renderer, not authenticated inference or backend model identity.",
+              "Workspace trust defaults off. Only never approval is supported. Explicit unsupported controls block dispatch.",
+              "Self-delegation must be explicitly allowed by policy; no native child-denial flag is assumed."
             ],
             "health": {
               "version": 1,