@astrosheep/keiyaku 4.5.19 → 4.5.20

package/build/integrations/marketplace/plugins/keiyaku/skills/keiyaku/SKILL.md

@@ -36,15 +36,22 @@ keiyaku -C <repo> review [<contract>|@<contract>] --satisfied
 ```
 
 ```bash
-keiyaku -C <cwd> call <akuma-name> [--contract <kei/...>] [--alias @name] [--allowed <product.action>]... [--schema <file>] [--wait <duration> | -d | --detach] [--json] (<prompt> | -)
+keiyaku -C <cwd> call <akuma-name> [--contract <kei/...>] [--workdir <path>] [--alias @name] [--allowed <product.action>]... [--schema <file>] [--wait <duration> | -d | --detach] (<prompt> | -)
 keiyaku -C <repo> wait <akuma-selector>... [--any | --all]
 keiyaku -C <repo> tell <aku/...|@alias> (<prompt> | -)
 ```
 
-`-C` is the invocation and Akuma execution cwd. Add `--repo <path>` only when
-a Contract or Dispatch reader must use a different Git repository.
+`-C` selects the invocation cwd and therefore the World. `--repo <path>` only
+selects the Contract repository; it never retargets that World. `call
+--workdir <path>` selects execution cwd (relative to the effective invocation
+cwd). Without it, a Contract call uses its appointed worktree and an
+unassociated call uses the invocation cwd.
 
 Repeated `--allowed` values add actions to the selected Akuma's defaults. A
 nested call can use only actions permitted by its direct parent Soul.
 
-Use text by default; add `--json` when a script needs structured output.
+`deliver`, `review`, and `audit` may take time after their leading admission.
+Their witnessed progress is ephemeral stderr output; stdout remains one final
+text or JSON result. Ctrl-C asks the owned operation to stop and waits for its
+truthful final receipt, so it is not evidence that an already admitted action
+was rolled back.

package/build/integrations/marketplace/plugins/keiyaku/skills/keiyaku-akuma/SKILL.md

@@ -15,7 +15,7 @@ is accepted; the identity underneath never changes.
 ## Start One
 
 ```bash
-keiyaku -C <cwd> call <akuma-name> [--alias @name] [--allowed <product.action>]... [--schema <file>] [--wait <duration> | -d | --detach] [--json] (<prompt> | -)
+keiyaku -C <cwd> call <akuma-name> [--workdir <path>] [--alias @name] [--allowed <product.action>]... [--schema <file>] [--wait <duration> | -d | --detach] (<prompt> | -)
 ```
 
 Give the worker's initial prompt as one argument (quote it when it contains
@@ -28,20 +28,30 @@ exclusive. Decide up front whether you will stay:
   work outlives your attention; come back with `wait`.
 
 `--alias @name` assigns that world-local selector to the born Akuma. If the
-Alias already points elsewhere, it moves to the born Akuma. The worker's
-execution cwd is exactly `-C <path>`, or your own cwd when `-C` is omitted.
+Alias already points elsewhere, it moves to the born Akuma. `-C` selects the
+invocation World; `--workdir <path>` selects the worker execution cwd relative
+to that invocation directory. Without `--workdir`, an unassociated call uses
+the invocation cwd, while a `--contract` call uses its appointed worktree.
 
-Repeated `--allowed` values add actions to the selected Akuma's defaults. A
-nested call can use only actions permitted by its direct parent Soul.
+Repeated `--allowed` values add actions to the selected Akuma's defaults; they
+never narrow them. An omitted Archetype default permits the complete action
+vocabulary, while an explicit empty default permits none. A nested call can use
+only actions permitted by its direct parent Soul. Use `status <aku/...|@alias>`
+to inspect the born worker's frozen effective actions.
 
 ## Akuma Names
 
-An Akuma name selects a Markdown file at `~/.keiyaku/akuma/<name>.md`; pass
-the filename without `.md` as `<akuma-name>`. Its frontmatter selects the
-provider and may declare `model`, `effort`, `readonly`, `network`, and
-`description`; the body is an optional system prompt, and an empty body keeps
-the harness default. If none grants the permissions and stance the work needs,
-add a new Akuma name. A born Akuma keeps its selected defaults for its lifetime.
+An Akuma name selects a reusable worker configuration, not an individual worker.
+Calling the same name multiple times creates independent workers with distinct
+AkuIds. Choose different names for different capabilities, not merely to run
+work in parallel.
+
+Each name fixes its own capability stance — provider, model, permissions —
+and a born Akuma keeps those selected defaults for its lifetime. `keiyaku ls
+aku/` lists the available names with their providers and descriptions. If none
+grants the permissions and stance the work needs, add a new Akuma name;
+`keiyaku settings --help` says where Akuma definitions live and what they may
+declare.
 
 ## Commission And Steer
 
@@ -64,6 +74,13 @@ including nested calls, which stay under this Soul's ceiling — and state the
 loop as the question. Steering that delegation afterwards goes to the holder,
 not around it.
 
+When that whole-loop worker must operate in the main repository rather than its
+Contract worktree, make that execution choice explicit:
+
+```bash
+keiyaku -C <repo> call worker --contract <kei/...> --workdir <repo> --allowed contract.deliver -d "Own this Contract loop."
+```
+
 ## Watch
 
 ```bash
@@ -78,9 +95,11 @@ a mode. When observing multiple Akuma, prefer one plural wait over separate
 waits and choose exactly one mode:
 
 ```bash
-keiyaku -C <cwd> wait @worker-a --timeout 5m
-keiyaku -C <cwd> wait @worker-a @worker-b --all --timeout 5m
-keiyaku -C <cwd> wait @worker-a @worker-b --any --timeout 5m
+keiyaku -C <cwd> call worker --alias @projection -d "Inspect the projection."
+keiyaku -C <cwd> call worker --alias @host-boundary -d "Inspect the host boundary."
+keiyaku -C <cwd> wait @projection --timeout 5m
+keiyaku -C <cwd> wait @projection @host-boundary --all --timeout 5m
+keiyaku -C <cwd> wait @projection @host-boundary --any --timeout 5m
 ```
 
 `--all` waits until every selected Akuma stops running. `--any` returns when the

package/build/integrations/marketplace/plugins/keiyaku/skills/keiyaku-task/SKILL.md

@@ -62,7 +62,6 @@ keiyaku task update <task-id> --title <text>
 keiyaku task context [<namespace>]
 ```
 
-Use `--json` on any command when a script must inspect the typed result.
 Relations are explicit facts: `needs` orders work, `parent` groups it,
 `supersedes` navigates replacement, and `relates` does not affect readiness.
 `task start` accepts one or more complete TaskIds. A single ID keeps the

package/build/src/akuma/akuma-observe.js

@@ -72,6 +72,7 @@ export async function bornStatus(paths, expected, input) {
         status: {
             id: soul.id,
             life: currentLife,
+            allowed: soul.allowed,
             ...(soul.readonly === undefined ? {} : { readonly: soul.readonly }),
             ...(resumeUnsupported ? { strandedReason: "resume-unsupported" } : {}),
             timeline: selected.snapshot,

package/build/src/akuma/akuma-product.d.ts

@@ -22,6 +22,7 @@ export type BornAkumaCall = Readonly<{
     }>;
     initialBody?: string;
     initialSchemaJson?: string;
+    awaitAsleep?: true;
     execution: BornExecution;
 }>;
 export type RequestedAkumaCall = Readonly<{

package/build/src/akuma/akuma-product.js

@@ -26,6 +26,7 @@ async function admitBodyRequest(input) {
         world: input.path,
         archetype: input.name,
         ...(input.call.body === undefined ? {} : { body: input.call.body }),
+        ...(input.call.schema === undefined ? {} : { awaitAsleep: true }),
         ...(cwd === undefined ? {} : { cwd }),
         recipe: input.recipe,
     });
@@ -56,6 +57,7 @@ async function admitDirect(input) {
         },
         ...(input.call.body === undefined ? {} : { initialBody: input.call.body }),
         ...(input.call.schema === undefined ? {} : { initialSchemaJson: schemaJsonText(input.call.schema) }),
+        ...(input.call.schema === undefined ? {} : { awaitAsleep: true }),
         execution: {
             cwd,
             source: input.call.cwd !== undefined ? "input" : initiatorCwd === undefined ? "world" : "process",
@@ -206,6 +208,7 @@ class AkumaProduct {
         }
         const published = await launchAkuma({
             allocated: born.allocated,
+            ...(born.awaitAsleep === undefined ? {} : { awaitAsleep: born.awaitAsleep }),
             launch: async (allocated) => await spawnAkumaBody({
                 paths: allocated.paths,
                 seed: born.seed,

package/build/src/akuma/akuma.d.ts

@@ -3,7 +3,7 @@ export type { KillEvidence };
 import { type AkuId } from "./identity.js";
 import type { Settings } from "../settings.js";
 import type { WorldRoot } from "../world.js";
-import type { AllowedAction } from "./allowed.js";
+import { type AllowedAction } from "./allowed.js";
 import type { ExecutionContext } from "./requests.js";
 import { z } from "zod";
 import type { BoundedList } from "../bounded-list.js";
@@ -32,6 +32,24 @@ export declare const akumaStatusSchema: z.ZodObject<{
         asleep: "asleep";
         stranded: "stranded";
     }>;
+    allowed: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+        "task.add": "task.add";
+        "task.addDocument": "task.addDocument";
+        "task.compose": "task.compose";
+        "task.done": "task.done";
+        "task.drop": "task.drop";
+        "task.hold": "task.hold";
+        "task.resume": "task.resume";
+        "task.start": "task.start";
+        "task.stop": "task.stop";
+        "task.update": "task.update";
+        "akuma.call": "akuma.call";
+        "akuma.kill": "akuma.kill";
+        "akuma.tell": "akuma.tell";
+        "contract.audit": "contract.audit";
+        "contract.deliver": "contract.deliver";
+        "contract.review": "contract.review";
+    }>>, z.ZodTransform<import("./allowed.js").AllowedActions, ("task.add" | "task.addDocument" | "task.compose" | "task.done" | "task.drop" | "task.hold" | "task.resume" | "task.start" | "task.stop" | "task.update" | "akuma.call" | "akuma.kill" | "akuma.tell" | "contract.audit" | "contract.deliver" | "contract.review")[]>>;
     readonly: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         enforcement: z.ZodLiteral<"native">;
     }, z.core.$strict>, z.ZodObject<{

package/build/src/akuma/akuma.js

@@ -1,5 +1,6 @@
 import { parseAkuId } from "./identity.js";
 import { activitySnapshotSchema } from "./projection.js";
+import { allowedActionsSchema } from "./allowed.js";
 import { z } from "zod";
 import { createAkumaProduct } from "./akuma-product.js";
 import { killAkumaWithRecovery } from "./akuma-handle.js";
@@ -25,6 +26,7 @@ export const akumaStatusSchema = z
     .object({
     id: akumaIdSchema,
     life: z.enum(["running", "asleep", "stranded", "hung", "untidy", "killed"]),
+    allowed: allowedActionsSchema,
     readonly: readonlySchema.optional(),
     timeline: activitySnapshotSchema,
     strandedReason: z.literal("resume-unsupported").optional(),

package/build/src/akuma/allowed.d.ts

@@ -1,8 +1,28 @@
+import { z } from "zod";
 export declare const ALLOWED_ACTIONS: readonly ["akuma.call", "akuma.kill", "akuma.tell", "contract.audit", "contract.deliver", "contract.review", "task.add", "task.addDocument", "task.compose", "task.done", "task.drop", "task.hold", "task.resume", "task.start", "task.stop", "task.update"];
 export type AllowedAction = (typeof ALLOWED_ACTIONS)[number];
 export type AllowedActions = readonly AllowedAction[];
 export declare function isAllowedAction(value: unknown): value is AllowedAction;
 export declare function decodeAllowedActions(value: unknown, label?: string): AllowedActions;
+/** Public codecs retain the Soul's canonical, duplicate-free action membership. */
+export declare const allowedActionsSchema: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+    "task.add": "task.add";
+    "task.addDocument": "task.addDocument";
+    "task.compose": "task.compose";
+    "task.done": "task.done";
+    "task.drop": "task.drop";
+    "task.hold": "task.hold";
+    "task.resume": "task.resume";
+    "task.start": "task.start";
+    "task.stop": "task.stop";
+    "task.update": "task.update";
+    "akuma.call": "akuma.call";
+    "akuma.kill": "akuma.kill";
+    "akuma.tell": "akuma.tell";
+    "contract.audit": "contract.audit";
+    "contract.deliver": "contract.deliver";
+    "contract.review": "contract.review";
+}>>, z.ZodTransform<AllowedActions, ("task.add" | "task.addDocument" | "task.compose" | "task.done" | "task.drop" | "task.hold" | "task.resume" | "task.start" | "task.stop" | "task.update" | "akuma.call" | "akuma.kill" | "akuma.tell" | "contract.audit" | "contract.deliver" | "contract.review")[]>>;
 export declare function effectiveAllowedActions(value: unknown): AllowedActions;
 export declare function unionAllowedActions(base: AllowedActions, additions: AllowedActions): AllowedActions;
 export declare function clipAllowedActions(requested: AllowedActions, parent: AllowedActions): AllowedActions;

package/build/src/akuma/allowed.js

@@ -1,4 +1,5 @@
 import { TASK_MUTATION_ACTIONS } from "../task/mutation.js";
+import { z } from "zod";
 export const ALLOWED_ACTIONS = Object.freeze([
     "akuma.call",
     "akuma.kill",
@@ -25,6 +26,16 @@ export function decodeAllowedActions(value, label = "allowed") {
     }
     return Object.freeze([...seen].sort());
 }
+/** Public codecs retain the Soul's canonical, duplicate-free action membership. */
+export const allowedActionsSchema = z.array(z.enum(ALLOWED_ACTIONS)).transform((value, context) => {
+    try {
+        return decodeAllowedActions(value);
+    }
+    catch (error) {
+        context.addIssue({ code: "custom", message: error instanceof Error ? error.message : String(error) });
+        return z.NEVER;
+    }
+});
 export function effectiveAllowedActions(value) {
     return value === undefined ? ALLOWED_ACTIONS : decodeAllowedActions(value);
 }

package/build/src/akuma/archetype.js

@@ -132,6 +132,7 @@ function decodeArchetypeFields(values) {
     const effort = archetypeField(values, "effort");
     const readonly = archetypeReadonly(values);
     const network = archetypeEnum(values, "network", ["disabled", "enabled"]);
+    const sandbox = archetypeEnum(values, "sandbox", ["full-access"]);
     const description = archetypeField(values, "description");
     const allowedPresent = "allowed" in values;
     const allowed = allowedPresent ? effectiveAllowedActions(values.allowed) : undefined;
@@ -143,6 +144,7 @@ function decodeArchetypeFields(values) {
         ...(effort === undefined ? {} : { effort }),
         ...(readonly === undefined ? {} : { readonly }),
         ...(network === undefined ? {} : { network }),
+        ...(sandbox === undefined ? {} : { sandbox }),
         ...(description === undefined ? {} : { description }),
         ...(allowed === undefined ? {} : { allowed }),
         allowedPresent,
@@ -166,6 +168,7 @@ function decodeArchetype(name, path, markdown) {
             ...(fields.model === undefined ? {} : { model: fields.model }),
             ...(fields.effort === undefined ? {} : { effort: fields.effort }),
             ...(fields.network === undefined ? {} : { network: fields.network }),
+            ...(fields.sandbox === undefined ? {} : { sandbox: fields.sandbox }),
             ...(systemPrompt.length === 0
                 ? {}
                 : {

package/build/src/akuma/body.js

@@ -231,13 +231,11 @@ async function recoverBodyRequests(input) {
 }
 function turnOutcomeEmitter(launch, soul) {
     let plugins;
-    const pending = new Set();
     const reportDiagnostic = (message) => {
         void recordPluginDiagnostic(launch.paths, "turn outcome", message);
     };
-    const emit = (turnSequence, outcome) => {
-        let delivery;
-        delivery = (async () => {
+    return {
+        async emit(turnSequence, outcome) {
             try {
                 plugins ??= pluginRuntime({
                     world: await World.at(worldRootForAkumaPaths(launch.paths)),
@@ -256,17 +254,8 @@ function turnOutcomeEmitter(launch, soul) {
             catch (error) {
                 await recordPluginDiagnostic(launch.paths, "turn outcome", error);
             }
-        })().finally(() => pending.delete(delivery));
-        pending.add(delivery);
-        return delivery;
-    };
-    const drain = async () => {
-        while (pending.size > 0)
-            await Promise.all([...pending]);
-        if (plugins !== undefined)
-            await (await plugins).drain("akuma.turn-outcome");
+        },
     };
-    return { emit, drain };
 }
 function bodyEndEmitter(launch, soul) {
     let plugins;
@@ -288,7 +277,6 @@ function bodyEndEmitter(launch, soul) {
                 ...(diagnostic === undefined ? {} : { diagnostic }),
                 ...(launch.completion?.contractId === undefined ? {} : { contractId: launch.completion.contractId }),
             }, reportDiagnostic);
-            await (await plugins).drain("akuma.body-ended");
         }
         catch (error) {
             await recordPluginDiagnostic(launch.paths, "body end", error);
@@ -346,7 +334,7 @@ async function runBodyTurns(input) {
             return;
         }
         const outcome = await persistTurn(launch.paths, result.turnSequence, result, runtime.now());
-        void turnOutcome.emit(result.turnSequence, outcome);
+        await turnOutcome.emit(result.turnSequence, outcome);
         if (outcome.outcome === "failed") {
             await failOpenBoundTurnsIfPresent(launch.paths, bodySequence, outcome.diagnostic, runtime.now());
             await breakBody(launch.paths, { sequence: bodySequence, end: "broke-off", at: runtime.now() });
@@ -508,19 +496,13 @@ export async function driveAkumaBody(launch, adapter, runtimeInput = {}) {
             await resolveDecidedPendingTellDisposition(launch.paths, finished.decided, runtime.spawnBody ?? spawnAkumaBody);
         if (finished.notification !== undefined)
             await finished.notification;
-        void emitTurnOutcome?.drain();
     }
 }
 export async function spawnAkumaBody(launch) {
     return await spawnDetachedProcess(await bodyProcessInput(launch));
 }
 export async function runAkumaBody(launch, world, externalCommands) {
-    try {
-        return await driveAkumaBody(launch, undefined, { world, externalCommands });
-    }
-    finally {
-        await (await pluginRuntime({ world })).drain();
-    }
+    return await driveAkumaBody(launch, undefined, { world, externalCommands });
 }
 const DIRECT_TELL_WAKE = {
     spawn: async (paths) => await spawnAkumaBody({ paths, refuseIfHeld: true }),

package/build/src/akuma/call-request.d.ts

@@ -19,6 +19,7 @@ declare const akumaCallRecipeSchema: z.ZodObject<{
         effort?: string;
         readonly?: true;
         network?: "disabled" | "enabled";
+        sandbox?: "full-access";
         systemPrompt?: string;
         systemPromptMode?: import("./provider-recipe.js").SystemPromptMode;
     }>, unknown>>;
@@ -28,6 +29,7 @@ declare const akumaCallPayloadSchema: z.ZodObject<{
     world: z.ZodString;
     archetype: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     body: z.ZodOptional<z.ZodString>;
+    awaitAsleep: z.ZodOptional<z.ZodLiteral<true>>;
     cwd: z.ZodOptional<z.ZodString>;
     recipe: z.ZodObject<{
         description: z.ZodOptional<z.ZodString>;
@@ -44,6 +46,7 @@ declare const akumaCallPayloadSchema: z.ZodObject<{
             effort?: string;
             readonly?: true;
             network?: "disabled" | "enabled";
+            sandbox?: "full-access";
             systemPrompt?: string;
             systemPromptMode?: import("./provider-recipe.js").SystemPromptMode;
         }>, unknown>>;

package/build/src/akuma/call-request.js

@@ -4,7 +4,7 @@ import { refuseRequest, reserveRequest } from "./heart/index.js";
 import { archetypeName, parseAkuId } from "./identity.js";
 import { publishAkuma } from "./publication.js";
 import { decodeProviderOptions, decodeReadonlyRestraint } from "./provider-recipe.js";
-import { decodeProviderExecution } from "./providers/index.js";
+import { decodeProviderExecution, resolveProviderExecution } from "./providers/index.js";
 import { requestBodyCommand } from "./request-rendezvous.js";
 import { eraseRequestCommand, } from "./request-wire.js";
 import { z } from "zod";
@@ -67,6 +67,7 @@ const akumaCallPayloadSchema = z
     world: absolutePathSchema,
     archetype: archetypeSchema,
     body: z.string().optional(),
+    awaitAsleep: z.literal(true).optional(),
     cwd: absolutePathSchema.optional(),
     recipe: akumaCallRecipeSchema,
 })
@@ -86,17 +87,24 @@ async function executeAkumaCall(request, facts, capabilities) {
         await refuseRequest(paths, facts.id, `request world ${requestWorld} does not match ${world}`);
         throw new Error(`request world ${requestWorld} does not match ${world}`);
     }
+    const selected = await resolveProviderExecution(request.recipe.provider);
+    const admission = selected.adapter.admitOptions(request.recipe.options);
+    if (admission.kind === "refused") {
+        await refuseRequest(paths, facts.id, admission.diagnostic);
+        throw new Error(admission.diagnostic);
+    }
     const recipe = {
         ...(request.recipe.description === undefined ? {} : { description: request.recipe.description }),
         allowed: clipAllowedActions(request.recipe.allowed, parent.allowed),
-        provider: request.recipe.provider,
-        options: request.recipe.options,
-        ...(request.recipe.readonly === undefined ? {} : { readonly: request.recipe.readonly }),
+        provider: selected.execution,
+        options: admission.options,
+        ...(admission.readonly === undefined ? {} : { readonly: admission.readonly }),
     };
     const published = await publishAkuma({
         worldPath: world,
         archetype: request.archetype,
         signal: facts.signal,
+        ...(request.awaitAsleep === undefined ? {} : { awaitAsleep: request.awaitAsleep }),
         launch: async (allocated) => {
             if (!facts.admissionOpen())
                 throw new Error("body closed request admission");

package/build/src/akuma/fleet-observation.d.ts

@@ -10,6 +10,24 @@ declare const akumaObservationSchema: z.ZodObject<{
             asleep: "asleep";
             stranded: "stranded";
         }>;
+        allowed: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+            "task.add": "task.add";
+            "task.addDocument": "task.addDocument";
+            "task.compose": "task.compose";
+            "task.done": "task.done";
+            "task.drop": "task.drop";
+            "task.hold": "task.hold";
+            "task.resume": "task.resume";
+            "task.start": "task.start";
+            "task.stop": "task.stop";
+            "task.update": "task.update";
+            "akuma.call": "akuma.call";
+            "akuma.kill": "akuma.kill";
+            "akuma.tell": "akuma.tell";
+            "contract.audit": "contract.audit";
+            "contract.deliver": "contract.deliver";
+            "contract.review": "contract.review";
+        }>>, z.ZodTransform<import("./allowed.js").AllowedActions, ("task.add" | "task.addDocument" | "task.compose" | "task.done" | "task.drop" | "task.hold" | "task.resume" | "task.start" | "task.stop" | "task.update" | "akuma.call" | "akuma.kill" | "akuma.tell" | "contract.audit" | "contract.deliver" | "contract.review")[]>>;
         readonly: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
             enforcement: z.ZodLiteral<"native">;
         }, z.core.$strict>, z.ZodObject<{
@@ -446,6 +464,24 @@ declare const akumaWaitResultSchema: z.ZodObject<{
                 asleep: "asleep";
                 stranded: "stranded";
             }>;
+            allowed: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+                "task.add": "task.add";
+                "task.addDocument": "task.addDocument";
+                "task.compose": "task.compose";
+                "task.done": "task.done";
+                "task.drop": "task.drop";
+                "task.hold": "task.hold";
+                "task.resume": "task.resume";
+                "task.start": "task.start";
+                "task.stop": "task.stop";
+                "task.update": "task.update";
+                "akuma.call": "akuma.call";
+                "akuma.kill": "akuma.kill";
+                "akuma.tell": "akuma.tell";
+                "contract.audit": "contract.audit";
+                "contract.deliver": "contract.deliver";
+                "contract.review": "contract.review";
+            }>>, z.ZodTransform<import("./allowed.js").AllowedActions, ("task.add" | "task.addDocument" | "task.compose" | "task.done" | "task.drop" | "task.hold" | "task.resume" | "task.start" | "task.stop" | "task.update" | "akuma.call" | "akuma.kill" | "akuma.tell" | "contract.audit" | "contract.deliver" | "contract.review")[]>>;
             readonly: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
                 enforcement: z.ZodLiteral<"native">;
             }, z.core.$strict>, z.ZodObject<{
@@ -1001,6 +1037,24 @@ export declare const fleetResultSchemas: {
                     asleep: "asleep";
                     stranded: "stranded";
                 }>;
+                allowed: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+                    "task.add": "task.add";
+                    "task.addDocument": "task.addDocument";
+                    "task.compose": "task.compose";
+                    "task.done": "task.done";
+                    "task.drop": "task.drop";
+                    "task.hold": "task.hold";
+                    "task.resume": "task.resume";
+                    "task.start": "task.start";
+                    "task.stop": "task.stop";
+                    "task.update": "task.update";
+                    "akuma.call": "akuma.call";
+                    "akuma.kill": "akuma.kill";
+                    "akuma.tell": "akuma.tell";
+                    "contract.audit": "contract.audit";
+                    "contract.deliver": "contract.deliver";
+                    "contract.review": "contract.review";
+                }>>, z.ZodTransform<import("./allowed.js").AllowedActions, ("task.add" | "task.addDocument" | "task.compose" | "task.done" | "task.drop" | "task.hold" | "task.resume" | "task.start" | "task.stop" | "task.update" | "akuma.call" | "akuma.kill" | "akuma.tell" | "contract.audit" | "contract.deliver" | "contract.review")[]>>;
                 readonly: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
                     enforcement: z.ZodLiteral<"native">;
                 }, z.core.$strict>, z.ZodObject<{

package/build/src/akuma/fleet-request.js

@@ -100,7 +100,8 @@ export function fleetRequestProtocol(action) {
         decodeResult: (result) => decodedFleetResult(action, result),
         decodeReference: (reference) => decodeFleetService(action, reference),
         isPermitted: (allowed) => action === "akuma.wait" ||
-            ((action === "akuma.tell" || action === "akuma.tell-answer") && allowed.includes("akuma.tell")),
+            ((action === "akuma.tell" || action === "akuma.tell-answer") && allowed.includes("akuma.tell")) ||
+            (action === "akuma.kill" && allowed.includes("akuma.kill")),
     };
 }
 export function fleetRequestCommand(action, port) {

package/build/src/akuma/provider-recipe.d.ts

@@ -4,6 +4,7 @@ export type ProviderOptions = Readonly<{
     effort?: string;
     readonly?: true;
     network?: "disabled" | "enabled";
+    sandbox?: "full-access";
     systemPrompt?: string;
     systemPromptMode?: SystemPromptMode;
 }>;

package/build/src/akuma/provider-recipe.js

@@ -33,6 +33,10 @@ export function decodeProviderOptions(value) {
     if (network !== undefined && network !== "disabled" && network !== "enabled") {
         throw new TypeError("provider option network must be disabled, enabled");
     }
+    const sandbox = options.sandbox;
+    if (sandbox !== undefined && sandbox !== "full-access") {
+        throw new TypeError("provider option sandbox must be full-access");
+    }
     const systemPrompt = optionText(options, "systemPrompt", "allow");
     const systemPromptMode = options.systemPromptMode;
     if (systemPromptMode !== undefined) {
@@ -48,6 +52,7 @@ export function decodeProviderOptions(value) {
         ...(effort === undefined ? {} : { effort }),
         ...(options.readonly === undefined ? {} : { readonly: true }),
         ...(network === undefined ? {} : { network }),
+        ...(sandbox === undefined ? {} : { sandbox }),
         ...(systemPrompt === undefined ? {} : { systemPrompt }),
         ...(systemPromptMode === undefined ? {} : { systemPromptMode }),
     });

package/build/src/akuma/providers/acp/index.js

@@ -3,6 +3,9 @@ import { decodeAcpConfig } from "./config.js";
 import { startAcpSession } from "./core.js";
 export { decodeAcpConfig } from "./config.js";
 function optionAdmission(options, config) {
+    if (options.sandbox !== undefined) {
+        return { kind: "refused", diagnostic: "ACP provider does not support the sandbox option" };
+    }
     if (options.network !== undefined) {
         return { kind: "refused", diagnostic: "ACP provider does not support the network option" };
     }

package/build/src/akuma/providers/claude/index.js

@@ -38,6 +38,9 @@ class ReceiptChannel {
     }
 }
 function admitClaudeOptions(options) {
+    if (options.sandbox !== undefined) {
+        return { kind: "refused", diagnostic: "Claude provider does not support the sandbox option" };
+    }
     if (options.network !== undefined) {
         return { kind: "refused", diagnostic: "Claude provider does not support the network option" };
     }

package/build/src/akuma/providers/codex-app-server/index.js

@@ -48,6 +48,8 @@ async function steerTurn(server, state, tell) {
     return { kind: "accepted", fence: `${accepted}:${tell.id}` };
 }
 function sandbox(cwd, options, requests) {
+    if (options.sandbox === "full-access")
+        return { type: "dangerFullAccess" };
     if (options.readonly === true) {
         return { type: "readOnly", networkAccess: options.network === "enabled" };
     }
@@ -228,6 +230,12 @@ export function createCodexAppServerProvider(input = "codex") {
     const execution = typeof input === "string" ? { name: "codex-app-server", kind: "codex-app-server", executable: input } : input;
     return {
         admitOptions(options) {
+            if (options.sandbox === "full-access" && options.readonly === true) {
+                return { kind: "refused", diagnostic: "Codex full-access sandbox cannot combine with readonly" };
+            }
+            if (options.sandbox === "full-access" && options.network === "disabled") {
+                return { kind: "refused", diagnostic: "Codex full-access sandbox cannot combine with disabled network" };
+            }
             return {
                 kind: "admitted",
                 options: Object.freeze({ ...options }),

package/build/src/akuma/providers/grok-build/index.js

@@ -67,6 +67,9 @@ export const interpretGrokTool = (update) => {
         fileChangeCall(name, input));
 };
 function optionAdmission(options) {
+    if (options.sandbox !== undefined) {
+        return { kind: "refused", diagnostic: "Grok Build does not support the sandbox option" };
+    }
     if (options.network !== undefined) {
         return { kind: "refused", diagnostic: "Grok Build does not support the network option" };
     }

package/build/src/akuma/providers/opencode-sdk/index.js

@@ -22,6 +22,8 @@ function opencodeSessionId(coordinateValue) {
     return coordinateValue.sessionId;
 }
 function admit(options) {
+    if (options.sandbox !== undefined)
+        throw new Error("OpenCode does not support the sandbox option");
     if (options.network !== undefined)
         throw new Error("OpenCode does not support explicit network");
     if (options.systemPromptMode === "replace") {

package/build/src/akuma/providers/pi/index.js

@@ -7,6 +7,8 @@ function diagnostic(error) {
     return error instanceof Error ? error.message : String(error);
 }
 function admitPiOptions(options) {
+    if (options.sandbox !== undefined)
+        return { kind: "refused", diagnostic: "Pi provider does not support the sandbox option" };
     if (options.network !== undefined)
         return { kind: "refused", diagnostic: "Pi provider does not support the network option" };
     if (options.model !== undefined && !MODEL_PATTERN.test(options.model)) {