@aiwg/cli 2026.10.9 → 2026.10.11

package/dist/src/serve/worker-invocation-preparation.js

@@ -0,0 +1,169 @@
+/** Validate and render a prepared invocation against trusted installation controls. */
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { validateWorkerArtifacts } from './worker-artifacts.mjs';
+import { assertValidWorkerPayload } from '../mission-protocol/codecs.js';
+import { qualificationDigest } from '../models/qualification-digest.mjs';
+import { qualifyWorkerInvocationProfile, assertOperatorWorkerNativeArgv, assertWorkerSelectionAllowed, assertWorkerLaunchMode, requiresWorkerExternalBoundary, assertWorkerHealthQualification, WorkerPolicyError, DEFAULT_WORKER_SELECTION } from '../models/provider-policy.js';
+/**
+ * The exact digest formula an MCP worker binding's `inputSchemaDigest`/
+ * `outputSchemaDigest` are pinned against (used below and reused verbatim by
+ * the #2892 MCP worker-invoke bridge's own live `tools/list` schema-drift
+ * check — see `src/mcp/tools/worker-invoke.mjs` M3). Deliberately the raw
+ * `JSON.stringify` of the schema object, NOT `workerConfigDigest`'s
+ * canonicalized (sorted-key) form — a schema's own declared key order is
+ * part of what gets pinned at qualification time.
+ */
+export function mcpToolSchemaDigest(schema) {
+    return `sha256:${createHash('sha256').update(JSON.stringify(schema)).digest('hex')}`;
+}
+export async function prepareWorkerInvocation(invocation, qualification) {
+    const result = structuredClone(invocation);
+    validateWorkerArtifacts(result);
+    // shellCommand is derived syntax, never authority supplied by a brief.
+    if (result.transport === 'shell')
+        result.shellCommand = '';
+    // Validate the established invocation shape first. Health is optional and
+    // is checked after policy, installation and transport qualification below.
+    const contract = { ...result };
+    delete contract.health;
+    assertValidWorkerPayload('workerResolvedInvocation', contract);
+    if ((qualification.platform ?? process.platform) !== 'linux') {
+        throw new Error('Unsupported worker invocation platform; Linux is required');
+    }
+    if (!Number.isFinite(qualification.now) || Date.parse(result.expiresAt) <= qualification.now) {
+        throw new Error('Worker invocation is expired or has no validation clock');
+    }
+    if (qualification.adapter.id !== qualification.adapterId) {
+        throw new Error('Worker invocation adapter identity mismatch');
+    }
+    assertWorkerLaunchMode(qualification.adapter, qualification.permissions);
+    if (result.isolation !== undefined && result.isolation !== (qualification.permissions?.launchMode ?? 'systemd-unit')) {
+        throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker launch mode differs from the execution policy');
+    }
+    for (const [key, value] of Object.entries(qualification.expectedDigests ?? {})) {
+        if (result[key] !== value)
+            throw new WorkerPolicyError('OG_PIN_MISMATCH', `Worker invocation ${key} changed`);
+    }
+    const verified = Date.parse(qualification.adapter.qualification.verifiedAt ?? '');
+    const policyDays = qualification.policy?.freshness?.policyDays ?? DEFAULT_WORKER_SELECTION.freshness.policyDays;
+    if (!Number.isFinite(verified) || verified > qualification.now || qualification.now - verified >= policyDays * 86400000) {
+        throw new Error('Worker installation qualification is stale or invalid');
+    }
+    assertWorkerSelectionAllowed(result.selected, qualification);
+    const profile = qualifyWorkerInvocationProfile(qualification.adapter, {
+        profile: result.selected.profileRef, transport: result.transport,
+        cliVersion: qualification.cliVersion,
+        requiredControls: qualification.requiredControls, policy: qualification.policy,
+        permissions: qualification.permissions, effort: result.selected.effort.value, boundary: qualification.boundary,
+        mcp: qualification.mcp,
+    });
+    if (requiresWorkerExternalBoundary(qualification.adapter, { ...qualification,
+        profile: result.selected.profileRef, transport: result.transport, effort: result.selected.effort.value })) {
+        const installed = qualification.installation;
+        const evidence = profile.installationQualification;
+        if (!installed || !evidence || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef']
+            .some(key => installed.evidence?.[key] !== evidence[key])
+            || !qualification.boundary || qualificationDigest(qualification.boundary) !== qualificationDigest(installed.boundary)) {
+            throw new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED', 'Worker installation evidence and qualified boundary must match');
+        }
+    }
+    if (profile.installationQualification) {
+        const installedAt = Date.parse(profile.installationQualification.verifiedAt);
+        if (!Number.isFinite(installedAt) || installedAt > qualification.now
+            || qualification.now - installedAt >= policyDays * 86400000) {
+            throw new Error('Worker installation qualification is stale or invalid');
+        }
+    }
+    const scopeDigest = profile.installationQualification?.scopeDigest ?? qualification.adapter.qualification.fixtureDigest;
+    if (result.selected.qualificationDigest !== scopeDigest)
+        throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker qualification digest changed');
+    const absolute = (value) => typeof value === 'string' && path.posix.isAbsolute(value) && !value.includes('\0');
+    for (const key of ['cwd', 'briefPath', 'stdoutPath', 'stderrPath', 'finalPath']) {
+        if (!absolute(result[key]))
+            throw new Error(`Worker invocation requires absolute ${key}`);
+    }
+    const briefPath = path.posix.normalize(result.briefPath);
+    if ([result.stdoutPath, result.stderrPath, result.finalPath].some(value => path.posix.normalize(value) === briefPath)
+        || path.posix.normalize(result.stdoutPath) === path.posix.normalize(result.stderrPath)) {
+        throw new Error('Worker invocation input/output paths must be distinct');
+    }
+    if (result.transport === 'shell') {
+        assertOperatorWorkerNativeArgv(qualification.adapter, result.argv, result.selected, qualification.permissions);
+        if (!absolute(result.argv[0]) || result.argv[0].includes('=') || result.argv.some(value => value.includes('\0'))) {
+            throw new WorkerPolicyError('OG_CONFIG_REFERENCE', 'Worker invocation requires an absolute binary without equals and NUL-free argv');
+        }
+        if (result.envNames.some(name => !profile.envAllowlist.includes(name))) {
+            throw new Error('Worker invocation environment is outside the qualified allowlist');
+        }
+        const quote = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
+        // Only validated environment names appear as shell syntax; their values
+        // remain in the conductor environment and are never printed in the plan.
+        const environment = result.envNames.map(name => `${name}="\${${name}-}"`).join(' ');
+        // The frozen 'closed' value means empty stdin (immediate EOF). 'brief-json'
+        // pipes a conductor-built params document framed from the brief file
+        // (worker-stdin-frame.mjs), so brief text never enters any argv.
+        const worker = `env -i${environment ? ` ${environment}` : ''} ${result.argv.map(quote).join(' ')}`;
+        const outputs = `> ${quote(result.stdoutPath)} 2> ${quote(result.stderrPath)}`;
+        if (result.stdin === 'brief-json') {
+            const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));
+            const frame = [process.execPath, framer, result.briefPath, result.selected.model, result.cwd].map(quote).join(' ');
+            result.shellCommand = `cd ${quote(result.cwd)} && env -i ${frame} | ${worker} ${outputs}`;
+        }
+        else if (result.stdin === 'adapter-frame') {
+            const binding = qualification.stdinFramerBinding;
+            if (!binding || !absolute(binding.storePath) || !/^sha256:[a-f0-9]{64}$/.test(binding.storeDigest)) {
+                throw new Error('Adapter stdin framer requires a trusted installation binding');
+            }
+            const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));
+            const frame = [process.execPath, framer, '--adapter-frame', result.briefPath, result.cwd,
+                result.selected.cli, qualification.adapterId, result.selected.qualificationDigest, result.briefDigest,
+                binding.storePath, binding.storeDigest, JSON.stringify(qualification.policy ?? null), result.selected.model].map(quote).join(' ');
+            result.shellCommand = `cd ${quote(result.cwd)} && env -i${environment ? ` ${environment}` : ''} ${frame} | ${worker} ${outputs}`;
+        }
+        else if (result.stdin === 'closed' || result.stdin === 'brief-text') {
+            const stdin = result.stdin === 'closed' ? '< /dev/null' : `< ${quote(result.briefPath)}`;
+            result.shellCommand = `cd ${quote(result.cwd)} && ${worker} ${stdin} ${outputs}`;
+        }
+        else {
+            throw new Error(`Unsupported worker stdin mode: ${result.stdin}`);
+        }
+    }
+    else {
+        const binding = result.mcp;
+        for (const key of ['serverRef', 'tool', 'inputSchemaDigest', 'outputSchemaDigest', 'sessionIsolation']) {
+            if (binding[key] !== profile.mcp[key])
+                throw new WorkerPolicyError('OG_PIN_MISMATCH', `MCP worker binding changed: ${key}`);
+        }
+        if (binding.timeoutSeconds > result.limits.wallSeconds) {
+            throw new Error('MCP worker timeout exceeds the invocation deadline');
+        }
+        for (const key of ['input', 'output']) {
+            const schema = qualification.mcpSchemas?.[key];
+            if (!schema || mcpToolSchemaDigest(schema) !== binding[`${key}SchemaDigest`]) {
+                throw new WorkerPolicyError('OG_PIN_MISMATCH', `MCP worker ${key} schema digest changed`);
+            }
+        }
+        const { default: Ajv2020 } = await import('ajv/dist/2020.js');
+        const { default: addFormats } = await import('ajv-formats');
+        const validate = addFormats(new Ajv2020({ strict: true, allErrors: true })).compile(qualification.mcpSchemas.input);
+        if (!validate(binding.arguments))
+            throw new Error('MCP worker arguments violate the pinned input schema');
+    }
+    assertValidWorkerPayload('workerResolvedInvocation', result);
+    if (result.health !== undefined) {
+        if (result.health.profileRef !== result.selected.profileRef
+            || result.health.hardTimeoutSeconds > Math.min(result.limits.wallSeconds, result.mcp?.timeoutSeconds ?? Infinity)) {
+            throw new Error('Worker health profile or wall ceiling mismatch');
+        }
+        if (['native', 'external'].includes(result.health.stepEnforcement)
+            && profile.controls.stepCap?.support !== result.health.stepEnforcement)
+            throw new Error('Unqualified worker step enforcement');
+    }
+    assertWorkerHealthQualification(profile, { profileRef: result.selected.profileRef, cliVersion: qualification.cliVersion,
+        accountScope: qualification.installation?.accountScope ?? '', inferenceProvider: result.selected.inferenceProvider,
+        model: result.selected.model, effort: result.selected.effort.value });
+    return result;
+}
+//# sourceMappingURL=worker-invocation-preparation.js.map

package/dist/src/serve/worker-invocation.js

@@ -1,14 +1,17 @@
+import { WorkerRequestArgumentError } from './worker-command-request.js';
+export { parseWorkerCommandArgs } from './worker-command-request.js';
 /** One nonlaunching typed renderer shared by models resolve and Ralph. */
 import path from 'node:path';
-import { createHash } from 'node:crypto';
-import { constants } from 'node:fs';
-import { lstat, realpath, open } from 'node:fs/promises';
-import { fileURLToPath } from 'node:url';
+import { inspectWorkerPath as inspectPath, workerOutputPaths, readBrief, assertConductorWorkerPlan } from './worker-invocation-paths.js';
+export { inspectWorkerPath } from './worker-invocation-paths.js';
+import { createHash, randomUUID } from 'node:crypto';
 import { resolveWorkerPlan } from '../models/resolver.js';
 import { workerConfigDigest, validateWorkerHealthConfig } from '../config/aiwg-config.js';
 import { assertValidWorkerPayload } from '../mission-protocol/codecs.js';
 import { qualificationDigest } from '../models/qualification-digest.mjs';
-import { qualifyWorkerInvocationProfile, isOperatorQualifiedWorkerAdapter, assertOperatorWorkerNativeArgv, assertWorkerSelectionAllowed, assertWorkerLaunchMode, WorkerRoleEffortError, requiredWorkerControls, requiresWorkerExternalBoundary, isCanonicalWorkerModelKey, assertWorkerHealthQualification, WorkerPolicyError, DEFAULT_WORKER_SELECTION } from '../models/provider-policy.js';
+import { prepareWorkerInvocation } from './worker-invocation-preparation.js';
+export { prepareWorkerInvocation, mcpToolSchemaDigest } from './worker-invocation-preparation.js';
+import { isOperatorQualifiedWorkerAdapter, assertOperatorWorkerNativeArgv, assertWorkerLaunchMode, WorkerRoleEffortError, requiredWorkerControls, isCanonicalWorkerModelKey, WorkerPolicyError, DEFAULT_WORKER_SELECTION } from '../models/provider-policy.js';
 /** Frozen per-attempt windows; parent/transport ceilings include time already spent. */
 export function resolveWorkerEffectiveHealth(config, input) {
     const roleDefaults = { efficiency: 1, coding: 1, reasoning: 2 };
@@ -70,165 +73,6 @@ export function resolveWorkerEffectiveHealth(config, input) {
     assertValidWorkerPayload('workerEffectiveHealth', health);
     return health;
 }
-/**
- * The exact digest formula an MCP worker binding's `inputSchemaDigest`/
- * `outputSchemaDigest` are pinned against (used below and reused verbatim by
- * the #2892 MCP worker-invoke bridge's own live `tools/list` schema-drift
- * check — see `src/mcp/tools/worker-invoke.mjs` M3). Deliberately the raw
- * `JSON.stringify` of the schema object, NOT `workerConfigDigest`'s
- * canonicalized (sorted-key) form — a schema's own declared key order is
- * part of what gets pinned at qualification time.
- */
-export function mcpToolSchemaDigest(schema) {
-    return `sha256:${createHash('sha256').update(JSON.stringify(schema)).digest('hex')}`;
-}
-export async function prepareWorkerInvocation(invocation, qualification) {
-    const result = structuredClone(invocation);
-    // shellCommand is derived syntax, never authority supplied by a brief.
-    if (result.transport === 'shell')
-        result.shellCommand = '';
-    // Validate the established invocation shape first. Health is optional and
-    // is checked after policy, installation and transport qualification below.
-    const contract = { ...result };
-    delete contract.health;
-    assertValidWorkerPayload('workerResolvedInvocation', contract);
-    if ((qualification.platform ?? process.platform) !== 'linux') {
-        throw new Error('Unsupported worker invocation platform; Linux is required');
-    }
-    if (!Number.isFinite(qualification.now) || Date.parse(result.expiresAt) <= qualification.now) {
-        throw new Error('Worker invocation is expired or has no validation clock');
-    }
-    if (qualification.adapter.id !== qualification.adapterId) {
-        throw new Error('Worker invocation adapter identity mismatch');
-    }
-    assertWorkerLaunchMode(qualification.adapter, qualification.permissions);
-    if (result.isolation !== undefined && result.isolation !== (qualification.permissions?.launchMode ?? 'systemd-unit')) {
-        throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker launch mode differs from the execution policy');
-    }
-    for (const [key, value] of Object.entries(qualification.expectedDigests ?? {})) {
-        if (result[key] !== value)
-            throw new WorkerPolicyError('OG_PIN_MISMATCH', `Worker invocation ${key} changed`);
-    }
-    const verified = Date.parse(qualification.adapter.qualification.verifiedAt ?? '');
-    const policyDays = qualification.policy?.freshness?.policyDays ?? DEFAULT_WORKER_SELECTION.freshness.policyDays;
-    if (!Number.isFinite(verified) || verified > qualification.now || qualification.now - verified >= policyDays * 86400000) {
-        throw new Error('Worker installation qualification is stale or invalid');
-    }
-    assertWorkerSelectionAllowed(result.selected, qualification);
-    const profile = qualifyWorkerInvocationProfile(qualification.adapter, {
-        profile: result.selected.profileRef, transport: result.transport,
-        cliVersion: qualification.cliVersion,
-        requiredControls: qualification.requiredControls, policy: qualification.policy,
-        permissions: qualification.permissions, effort: result.selected.effort.value, boundary: qualification.boundary,
-        mcp: qualification.mcp,
-    });
-    if (requiresWorkerExternalBoundary(qualification.adapter, { ...qualification,
-        profile: result.selected.profileRef, transport: result.transport, effort: result.selected.effort.value })) {
-        const installed = qualification.installation;
-        const evidence = profile.installationQualification;
-        if (!installed || !evidence || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef']
-            .some(key => installed.evidence?.[key] !== evidence[key])
-            || !qualification.boundary || qualificationDigest(qualification.boundary) !== qualificationDigest(installed.boundary)) {
-            throw new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED', 'Worker installation evidence and qualified boundary must match');
-        }
-    }
-    if (profile.installationQualification) {
-        const installedAt = Date.parse(profile.installationQualification.verifiedAt);
-        if (!Number.isFinite(installedAt) || installedAt > qualification.now
-            || qualification.now - installedAt >= policyDays * 86400000) {
-            throw new Error('Worker installation qualification is stale or invalid');
-        }
-    }
-    const scopeDigest = profile.installationQualification?.scopeDigest ?? qualification.adapter.qualification.fixtureDigest;
-    if (result.selected.qualificationDigest !== scopeDigest)
-        throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker qualification digest changed');
-    const absolute = (value) => typeof value === 'string' && path.posix.isAbsolute(value) && !value.includes('\0');
-    for (const key of ['cwd', 'briefPath', 'stdoutPath', 'stderrPath', 'finalPath']) {
-        if (!absolute(result[key]))
-            throw new Error(`Worker invocation requires absolute ${key}`);
-    }
-    const briefPath = path.posix.normalize(result.briefPath);
-    if ([result.stdoutPath, result.stderrPath, result.finalPath].some(value => path.posix.normalize(value) === briefPath)
-        || path.posix.normalize(result.stdoutPath) === path.posix.normalize(result.stderrPath)) {
-        throw new Error('Worker invocation input/output paths must be distinct');
-    }
-    if (result.transport === 'shell') {
-        assertOperatorWorkerNativeArgv(qualification.adapter, result.argv, result.selected, qualification.permissions);
-        if (!absolute(result.argv[0]) || result.argv[0].includes('=') || result.argv.some(value => value.includes('\0'))) {
-            throw new WorkerPolicyError('OG_CONFIG_REFERENCE', 'Worker invocation requires an absolute binary without equals and NUL-free argv');
-        }
-        if (result.envNames.some(name => !profile.envAllowlist.includes(name))) {
-            throw new Error('Worker invocation environment is outside the qualified allowlist');
-        }
-        const quote = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
-        // Only validated environment names appear as shell syntax; their values
-        // remain in the conductor environment and are never printed in the plan.
-        const environment = result.envNames.map(name => `${name}="\${${name}-}"`).join(' ');
-        // The frozen 'closed' value means empty stdin (immediate EOF). 'brief-json'
-        // pipes a conductor-built params document framed from the brief file
-        // (worker-stdin-frame.mjs), so brief text never enters any argv.
-        const worker = `env -i${environment ? ` ${environment}` : ''} ${result.argv.map(quote).join(' ')}`;
-        const outputs = `> ${quote(result.stdoutPath)} 2> ${quote(result.stderrPath)}`;
-        if (result.stdin === 'brief-json') {
-            const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));
-            const frame = [process.execPath, framer, result.briefPath, result.selected.model, result.cwd].map(quote).join(' ');
-            result.shellCommand = `cd ${quote(result.cwd)} && env -i ${frame} | ${worker} ${outputs}`;
-        }
-        else if (result.stdin === 'adapter-frame') {
-            const binding = qualification.stdinFramerBinding;
-            if (!binding || !absolute(binding.storePath) || !/^sha256:[a-f0-9]{64}$/.test(binding.storeDigest)) {
-                throw new Error('Adapter stdin framer requires a trusted installation binding');
-            }
-            const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));
-            const frame = [process.execPath, framer, '--adapter-frame', result.briefPath, result.cwd,
-                result.selected.cli, qualification.adapterId, result.selected.qualificationDigest, result.briefDigest,
-                binding.storePath, binding.storeDigest, JSON.stringify(qualification.policy ?? null)].map(quote).join(' ');
-            result.shellCommand = `cd ${quote(result.cwd)} && env -i${environment ? ` ${environment}` : ''} ${frame} | ${worker} ${outputs}`;
-        }
-        else if (result.stdin === 'closed' || result.stdin === 'brief-text') {
-            const stdin = result.stdin === 'closed' ? '< /dev/null' : `< ${quote(result.briefPath)}`;
-            result.shellCommand = `cd ${quote(result.cwd)} && ${worker} ${stdin} ${outputs}`;
-        }
-        else {
-            throw new Error(`Unsupported worker stdin mode: ${result.stdin}`);
-        }
-    }
-    else {
-        const binding = result.mcp;
-        for (const key of ['serverRef', 'tool', 'inputSchemaDigest', 'outputSchemaDigest', 'sessionIsolation']) {
-            if (binding[key] !== profile.mcp[key])
-                throw new WorkerPolicyError('OG_PIN_MISMATCH', `MCP worker binding changed: ${key}`);
-        }
-        if (binding.timeoutSeconds > result.limits.wallSeconds) {
-            throw new Error('MCP worker timeout exceeds the invocation deadline');
-        }
-        for (const key of ['input', 'output']) {
-            const schema = qualification.mcpSchemas?.[key];
-            if (!schema || mcpToolSchemaDigest(schema) !== binding[`${key}SchemaDigest`]) {
-                throw new WorkerPolicyError('OG_PIN_MISMATCH', `MCP worker ${key} schema digest changed`);
-            }
-        }
-        const { default: Ajv2020 } = await import('ajv/dist/2020.js');
-        const { default: addFormats } = await import('ajv-formats');
-        const validate = addFormats(new Ajv2020({ strict: true, allErrors: true })).compile(qualification.mcpSchemas.input);
-        if (!validate(binding.arguments))
-            throw new Error('MCP worker arguments violate the pinned input schema');
-    }
-    assertValidWorkerPayload('workerResolvedInvocation', result);
-    if (result.health !== undefined) {
-        if (result.health.profileRef !== result.selected.profileRef
-            || result.health.hardTimeoutSeconds > Math.min(result.limits.wallSeconds, result.mcp?.timeoutSeconds ?? Infinity)) {
-            throw new Error('Worker health profile or wall ceiling mismatch');
-        }
-        if (['native', 'external'].includes(result.health.stepEnforcement)
-            && profile.controls.stepCap?.support !== result.health.stepEnforcement)
-            throw new Error('Unqualified worker step enforcement');
-    }
-    assertWorkerHealthQualification(profile, { profileRef: result.selected.profileRef, cliVersion: qualification.cliVersion,
-        accountScope: qualification.installation?.accountScope ?? '', inferenceProvider: result.selected.inferenceProvider,
-        model: result.selected.model, effort: result.selected.effort.value });
-    return result;
-}
 const invocationChecks = {
     invocation_build_failed: { pointer: '/invocation/buildInvocation',
         message: 'Worker adapter could not build the invocation; check the selected model, effort, permissions and request paths.' },
@@ -269,127 +113,7 @@ export async function buildWorkerInvocationTransport(driver, input) {
     }
     return transport;
 }
-/** Only fixed argument guidance is safe to expose in public request diagnostics. */
-class WorkerRequestArgumentError extends WorkerPolicyError {
-    pointer;
-    constructor(key) {
-        super('OG_CONFIG_REFERENCE', key === 'task'
-            ? `Missing required --task. Valid task classes: ${Object.keys(DEFAULT_WORKER_SELECTION.taskClasses).join(', ')}, plus classes configured in defaults.workerSelection.taskClasses.`
-            : `--${key.replace('_', '-')} must be an absolute path; relative paths are not resolved against cwd or --workdir.`);
-        this.pointer = `/request/${key}`;
-    }
-}
-/** Reject unsupported syntax before discovery or any path reads. */
-export function parseWorkerCommandArgs(args) {
-    const names = { role: 'role', task: 'task', group: 'group', brief: 'brief',
-        workdir: 'workdir', 'final-output': 'final_output', transport: 'transport', format: 'format' };
-    const result = {};
-    let json = false;
-    let premiumAuthorized = false;
-    for (let i = 0; i < args.length; i++) {
-        const token = args[i];
-        if (token === '--authorize-premium') {
-            if (premiumAuthorized)
-                throw new Error('Duplicate --authorize-premium');
-            premiumAuthorized = true;
-            continue;
-        }
-        if (token === '--json') {
-            if (json)
-                throw new Error('Duplicate --json');
-            json = true;
-            continue;
-        }
-        const match = /^--([^=]+)(?:=([\s\S]*))?$/.exec(token);
-        if (!match || !Object.hasOwn(names, match[1]))
-            throw new Error(`Unsupported models resolve argument: ${token}`);
-        const key = names[match[1]];
-        if (key in result)
-            throw new Error(`Duplicate --${match[1]}`);
-        const value = match[2] ?? args[++i];
-        if (!value || value.startsWith('--') && match[2] === undefined || value.includes('\0')) {
-            if (key === 'task' && !value?.includes('\0'))
-                throw new WorkerRequestArgumentError('task');
-            throw new Error(`--${match[1]} requires a value`);
-        }
-        result[key] = value;
-    }
-    if (json && result.format && result.format !== 'json')
-        throw new Error('--json conflicts with --format');
-    if (json)
-        result.format = 'json';
-    for (const key of ['role', 'task', 'group', 'brief', 'workdir', 'final_output']) {
-        if (key === 'task' && !result[key])
-            throw new WorkerRequestArgumentError('task');
-        if (!result[key])
-            throw new Error(`Missing ${key}`);
-    }
-    if (!['efficiency', 'coding', 'reasoning'].includes(result.role))
-        throw new Error('Unsupported role');
-    if (!/^[a-z][a-z0-9-]{0,62}$/.test(result.group))
-        throw new Error('Invalid group');
-    if (result.transport && !['shell', 'mcp'].includes(result.transport))
-        throw new Error('Unsupported transport');
-    if (result.format && !['shell', 'json'].includes(result.format))
-        throw new Error('Unsupported renderer; use POSIX shell or JSON');
-    return { ...result, ...(premiumAuthorized ? { authority: { premiumAuthorized: true, maxAutoTier: 3 } } : {}) };
-}
 const bytesDigest = (bytes) => `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
-export async function inspectWorkerPath(filename, kind) {
-    if (!path.isAbsolute(filename) || filename.includes('\0'))
-        throw new Error('Absolute NUL-free paths are required');
-    if (filename.split('/').includes('..'))
-        throw new Error('Worker path traversal is not allowed');
-    const normalized = path.resolve(filename);
-    let current = normalized;
-    while (true) {
-        try {
-            const canonical = await realpath(current);
-            if (canonical !== current)
-                throw new Error(`Symlink path is not allowed: ${filename}`);
-            if (current !== normalized)
-                return false;
-            const stat = await lstat(normalized);
-            if (kind === 'directory' ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1) {
-                throw new Error(`Expected an unaliased ${kind}: ${filename}`);
-            }
-            return true;
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                throw error;
-            const parent = path.dirname(current);
-            if (parent === current)
-                throw error;
-            current = parent;
-        }
-    }
-}
-const inspectPath = inspectWorkerPath;
-async function readBrief(filename) {
-    if (!await inspectPath(filename, 'file'))
-        return null;
-    const handle = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-    try {
-        const stat = await handle.stat();
-        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 262144)
-            throw new Error('Brief must be a bounded regular file (256 KiB)');
-        const buffer = Buffer.alloc(262145);
-        let length = 0;
-        while (length < buffer.length) {
-            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, null);
-            if (!bytesRead)
-                break;
-            length += bytesRead;
-        }
-        if (length > 262144)
-            throw new Error('Brief exceeds 256 KiB');
-        return buffer.subarray(0, length);
-    }
-    finally {
-        await handle.close();
-    }
-}
 /** Structured root-check failure; only these explicit path details are public. */
 export class WorkerPathScopeError extends WorkerPolicyError {
     pointer;
@@ -399,7 +123,7 @@ export class WorkerPathScopeError extends WorkerPolicyError {
     }
 }
 /** Re-resolve saved JSON through the same trusted owners; saved argv is never authority. */
-export async function revalidateWorkerInvocationPlan(saved, snapshot, drivers, now = new Date().toISOString()) {
+export async function revalidateWorkerInvocationPlan(saved, snapshot, drivers, now = new Date().toISOString(), invocationPath) {
     const managed = saved.mode === 'managed' && snapshot.config.parallelism?.worker_mode === 'managed';
     if (!saved.request || (saved.mode !== 'direct' && !managed) || saved.mode !== (snapshot.config.parallelism?.worker_mode ?? 'direct') || saved.status !== 'eligible'
         || (managed && saved.invocation?.mode !== 'managed')
@@ -407,7 +131,9 @@ export async function revalidateWorkerInvocationPlan(saved, snapshot, drivers, n
         throw new Error('A fresh launchable models resolve JSON plan is required');
     }
     assertValidWorkerPayload('workerResolvedInvocation', saved.invocation);
-    const current = await resolveWorkerInvocation(snapshot, saved.request, drivers, now, { digests: saved.digests, briefDigest: saved.invocation.briefDigest ?? null });
+    if (saved.invocation.invocationId)
+        await assertConductorWorkerPlan(saved, invocationPath, drivers);
+    const current = await resolveWorkerInvocation(snapshot, saved.request, drivers, now, { digests: saved.digests, briefDigest: saved.invocation.briefDigest ?? null, invocationId: saved.invocation.invocationId });
     // Expiry is calculated from the resolution clock. All execution bindings,
     // controls, thresholds and paths must remain byte-for-byte digest equivalent.
     if (!current.invocation || current.status !== 'eligible'
@@ -449,7 +175,7 @@ export async function resolveWorkerInvocation(snapshot, request, drivers, now =
             if (managedIntent && workerConfigDigest(brief.intent) !== workerConfigDigest(managedIntent)) {
                 throw new Error('Managed brief differs from parent task authority');
             }
-            if (brief.intent.role !== request.role || brief.intent.taskClass !== request.task || brief.intent.group !== request.group
+            if (brief.intent.role !== (snapshot.models.defaults.workerSelection?.roleGuidance?.[request.role]?.baseRole ?? request.role) || brief.intent.taskClass !== request.task || brief.intent.group !== request.group
                 || brief.workspace.path !== request.workdir || brief.output.resultPath !== request.final_output) {
                 throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Brief role/task/group/workspace/output differs from request');
             }
@@ -545,14 +271,20 @@ export async function resolveWorkerInvocation(snapshot, request, drivers, now =
             requiredControls: healthConfig?.requireStepCap ? ['stepCap'] : [] });
         pointer = '/parallelism/health';
         failureCode = 'OG_ADAPTER_UNQUALIFIED';
-        const healthInput = { role: request.role, effort: tuple.effort,
+        const healthInput = { role: plan.policy?.roleGuidance?.[request.role]?.baseRole ?? request.role, effort: tuple.effort,
             modelKey: tuple.modelKey, profileRef: tuple.profile, wallSeconds: limits.wallSeconds,
             transportSeconds: adapter.invocation.kind === 'http' ? adapter.invocation.timeoutSeconds : undefined,
             stepEnforcement: controls.includes('stepCap') ? profile.controls.stepCap.support : 'unavailable' };
         let effectiveHealth = resolveWorkerEffectiveHealth(healthConfig, healthInput);
-        const transport = await buildWorkerInvocationTransport(driver, { selected: structuredClone(selected), permissions: structuredClone(tuple.permissions),
+        const invocationId = expected?.invocationId ?? randomUUID();
+        const transport = await buildWorkerInvocationTransport(driver, { invocationId, selected: structuredClone(selected), permissions: structuredClone(tuple.permissions),
             cwd: request.workdir, briefPath: request.brief, brief: bytes?.toString('utf8') ?? '', finalPath, limits: structuredClone(limits),
-            health: structuredClone(effectiveHealth) });
+            health: structuredClone(effectiveHealth), role: request.role });
+        for (const output of Object.values(workerOutputPaths({ ...transport, selected, transport: tuple.transport, finalPath, stdoutPath, stderrPath }))) {
+            await inspectPath(output, 'output');
+            if (path.resolve(request.brief) === output)
+                throw new Error('Brief and output paths must be distinct');
+        }
         pointer = '/invocation/buildInvocation';
         if (transport.stdin === 'adapter-frame' && typeof driver.buildWorkerStdinFrame !== 'function')
             throw new Error('Installed adapter stdin framer is required');
@@ -564,7 +296,8 @@ export async function resolveWorkerInvocation(snapshot, request, drivers, now =
             isolation: tuple.permissions.launchMode ?? 'systemd-unit',
             policyDigest, catalogDigest: plan.digests.catalogDigest, profileDigest: plan.digests.profileDigest,
             expiresAt, cwd: request.workdir, briefPath: request.brief, stdoutPath, stderrPath, finalPath,
-            ...(transport.artifacts ? { artifacts: transport.artifacts } : {}),
+            ...(transport.artifacts ? { artifacts: transport.artifacts,
+                ...(transport.artifacts.some(artifact => artifact.location === 'workspace-relative') ? { invocationId } : {}) } : {}),
             argv: transport.argv, stdin: transport.stdin, envNames: transport.envNames, mcp: transport.mcp,
             ...(tuple.transport === 'shell' ? { shellCommand: '' } : {}),
             readiness: bytes !== null && workspaceExists && outputParentsExist ? 'launchable' : 'preparatory', briefDigest,

package/dist/src/serve/worker-stdin-frame.d.mts

@@ -3,8 +3,8 @@ export const WORKER_STDIN_FRAME_MAX_BRIEF_BYTES: number;
 export const WORKER_STDIN_FRAME_MAX_BYTES: number;
 export function recordedWorkerStdinBytes(input: {
   filename: string; workspace: string; cli: string; adapterId: string; scopeDigest: string; briefDigest: string;
-  storePath: string; storeDigest: string; policy?: import('../models/types.js').WorkerSelectionPolicy;
+  storePath: string; storeDigest: string; model?: string; policy?: import('../models/types.js').WorkerSelectionPolicy;
 }): Promise<Buffer | null>;
 export function workerStdinDocument(input: { brief: string | Buffer; model: string; cwd: string }): string;
 export function workerStdinBytes(invocation: { stdin: 'closed' | 'brief-text' | 'brief-json' | 'adapter-frame'; cwd?: string;
-  selected?: { model?: string } }, brief: string | Buffer, adapter?: { buildWorkerStdinFrame?(brief: string | Buffer): string | Uint8Array }): Buffer | null;
+  selected?: { model?: string } }, brief: string | Buffer, adapter?: { buildWorkerStdinFrame?(brief: string | Buffer, invocation?: { selected?: { model?: string } }): string | Uint8Array }): Buffer | null;

package/dist/src/serve/worker-stdin-frame.mjs

@@ -39,7 +39,7 @@ export function workerStdinBytes(invocation, brief, adapter) {
   if (invocation.stdin === 'adapter-frame') {
     if (typeof adapter?.buildWorkerStdinFrame !== 'function') throw new Error('Installed adapter stdin framer is required');
     if (Buffer.byteLength(brief) > WORKER_STDIN_FRAME_MAX_BRIEF_BYTES) throw new Error('Brief exceeds the framing bound');
-    const frame = adapter.buildWorkerStdinFrame(brief);
+    const frame = adapter.buildWorkerStdinFrame(brief, invocation);
     if (typeof frame !== 'string' && !(frame instanceof Uint8Array)) throw new Error('Adapter stdin frame must be bytes or text');
     if (Buffer.byteLength(frame) === 0) throw new Error('Adapter stdin frame must not be empty');
     if (Buffer.byteLength(frame) > WORKER_STDIN_FRAME_MAX_BYTES) throw new Error('Adapter stdin frame exceeds byte bound');
@@ -67,7 +67,7 @@ async function readBounded(filename) {
 
 /** Bound host authority only; workspace is an execution scope, never a config source. */
 export async function recordedWorkerStdinBytes({ filename, workspace, cli, adapterId, scopeDigest, briefDigest,
-  storePath, storeDigest, policy }) {
+  storePath, storeDigest, policy, model }) {
   if (!filename?.startsWith('/') || !storePath?.startsWith('/')
     || !/^sha256:[a-f0-9]{64}$/.test(storeDigest ?? '')) throw new Error('Invalid adapter stdin framing request');
   const { loadRecordedWorkerInstallations } = await import('../models/worker-installation.mjs');
@@ -80,7 +80,7 @@ export async function recordedWorkerStdinBytes({ filename, workspace, cli, adapt
     || driver.qualification.installation?.evidence?.scopeDigest !== scopeDigest) throw new Error('Adapter stdin binding changed');
   const brief = await readBounded(filename);
   if (`sha256:${createHash('sha256').update(brief).digest('hex')}` !== briefDigest) throw new Error('Adapter stdin brief changed');
-  return workerStdinBytes({ stdin: 'adapter-frame' }, brief, driver);
+  return workerStdinBytes({ stdin: 'adapter-frame', selected: { model } }, brief, driver);
 }
 
 // Pipeline stage: `worker-stdin-frame.mjs BRIEF_PATH MODEL CWD`. Only the
@@ -89,13 +89,13 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   const [briefPath, model, cwd] = process.argv.slice(2);
   try {
     if (briefPath === '--adapter-frame') {
-      const [filename, workspace, cli, adapterId, scopeDigest, briefDigest, storePath, storeDigest, policyJson] = process.argv.slice(3);
-      if (process.argv.length !== 12) throw new Error('Invalid adapter stdin framing request');
+      const [filename, workspace, cli, adapterId, scopeDigest, briefDigest, storePath, storeDigest, policyJson, selectedModel] = process.argv.slice(3);
+      if (process.argv.length !== 13) throw new Error('Invalid adapter stdin framing request');
       // Reuse the recorded-installation loader; no module path or code supplied
       // by a brief is ever imported. The conductor binds store bytes and policy;
       // never resolve configuration from the worker-writable workspace.
       process.stdout.write(await recordedWorkerStdinBytes({ filename, workspace, cli, adapterId, scopeDigest, briefDigest,
-        storePath, storeDigest, policy: JSON.parse(policyJson) ?? undefined }));
+        storePath, storeDigest, policy: JSON.parse(policyJson) ?? undefined, model: selectedModel }));
     } else {
       if (process.argv.length !== 5 || !briefPath?.startsWith('/')) throw new Error('usage: worker-stdin-frame.mjs BRIEF_PATH MODEL CWD');
       process.stdout.write(workerStdinDocument({ brief: await readBounded(briefPath), model, cwd }));

package/dist/src/sessions/adapters/grokbot.js

@@ -152,6 +152,13 @@ export class GrokbotSessionAdapter {
      * rename-swap), not appended to. See the class-level doc comment.
      */
     sourceContinuity = 'snapshot';
+    /**
+     * Account scope (#3232): conversations carry no workspace identity, so
+     * every workspace authorizing the same `--grokbot-root` would otherwise
+     * import the same conversations. The importer routes account-scoped
+     * sources to the host catalog once; workspace catalogs keep a reference.
+     */
+    scopeClass = 'account';
     interchange;
     constructor(limits, maxFiles = 10_000) {
         this.limits = limits;