@cabane/companion 0.6.186 → 0.6.187

package/dist/cli.js

@@ -369,7 +369,6 @@ var init_prepare_hook = __esm({
               CABANE_AGENT_USERNAME: input.agentUsername,
               CABANE_DEFAULT_CWD: input.defaultCwd,
               CABANE_RUNTIME: input.runtime ?? "",
-              CABANE_HOST_ACCESS: input.hostAccess ? "1" : "0",
               // Newline-joined — workspace paths never contain a newline, so a
               // hook splits on `\n` unambiguously. Empty string when none.
               CABANE_TRIGGER_ENTRY_PATHS: input.triggerEntryPaths.join("\n"),
@@ -727,7 +726,7 @@ var init_config = __esm({
       // yourself, `claudeCode: { autoMemory: true }` hands auto-memory back to your
       // own `~/.claude/settings.json` — Cabane then stops
       // injecting the off switch and your normal Claude Code memory workflow applies
-      // (in coding mode, where the checkout's project settings are read).
+      // (the user and project settings load on every Claude Code turn).
       claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional()
     }).strict();
     agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema);
@@ -1722,45 +1721,13 @@ var init_version = __esm({
   }
 });
 
-// packages/agent-runtime/src/host-policy.ts
-import { z as z6 } from "zod";
-var hostPolicySchema;
-var init_host_policy = __esm({
-  "packages/agent-runtime/src/host-policy.ts"() {
-    "use strict";
-    hostPolicySchema = z6.object({
-      // Host filesystem and shell: `Bash`/`Read`/`Write`/`Edit`/`Glob`/`Grep`, the notebook pair,
-      // git-worktree tools and `REPL`. Off on the locked assistant surface; on in the coding posture.
-      hostFs: z6.boolean(),
-      // Public web (`WebSearch` / `WebFetch`). Not host reach; a grant like the rest.
-      web: z6.boolean(),
-      // Browser automation (the Playwright MCP surface). Varies by host.
-      browser: z6.boolean(),
-      // User-configured MCP servers permitted.
-      userMcp: z6.boolean(),
-      // Subagent dispatch (`Task` / `Agent`) — a grant: `false` on the locked surface, `true` in the
-      // coding posture, where the coding allow-hook reaches sub-agent tool calls. A subagent completes
-      // within the turn, so it's not an invariant like `scheduling`.
-      subagents: z6.boolean(),
-      // ── Hard platform invariants — always denied, never granted ────────────────
-      // Deferred re-invocation / scheduling (`ScheduleWakeup`, the `Cron*` / `Task*` families,
-      // `Monitor`, `Workflow`, …). A turn is one query that resolves on `result`; a scheduled callback
-      // fires after the reply window has closed and strands the agent.
-      scheduling: z6.literal("never"),
-      // Human-facing UI prompts (`AskUserQuestion`). Nothing in a Cabane conversation can answer a
-      // structured prompt, so the call hangs the turn. The agent asks in its reply instead.
-      uiPrompts: z6.literal("never")
-    });
-  }
-});
-
 // packages/agent-runtime/src/turn-event.ts
-import { z as z7 } from "zod";
+import { z as z6 } from "zod";
 var turnEventSchema;
 var init_turn_event = __esm({
   "packages/agent-runtime/src/turn-event.ts"() {
     "use strict";
-    turnEventSchema = z7.discriminatedUnion("type", [
+    turnEventSchema = z6.discriminatedUnion("type", [
       // The runtime's opaque session state, emitted when the adapter learns it (e.g. the SDK
       // `system/init` frame). The platform stores `state` verbatim per (conversation, agent) and
       // hands it back next turn; only the adapter knows what it means.
@@ -1772,21 +1739,21 @@ var init_turn_event = __esm({
       // server rewinds the mark, so the next turn rebuilds a full catch-up (this turn is unavoidably
       // lossy — the degrade is known only after the manifest was committed). A plain boolean; the
       // runtime-specific reason stays in the adapter's `onWarn` log. Optional.
-      z7.object({
-        type: z7.literal("session"),
-        state: z7.string(),
-        degraded: z7.boolean().optional()
+      z6.object({
+        type: z6.literal("session"),
+        state: z6.string(),
+        degraded: z6.boolean().optional()
       }),
       // One readable thinking summary. Transient — surfaced live, never persisted as content.
-      z7.object({ type: z7.literal("thinking"), text: z7.string() }),
+      z6.object({ type: z6.literal("thinking"), text: z6.string() }),
       // Assistant text. `terminal: false` is interim narration (commits as `progress`);
       // `terminal: true` is the turn's closing reply (commits as `final`).
-      z7.object({ type: z7.literal("text"), body: z7.string(), terminal: z7.boolean() }),
+      z6.object({ type: z6.literal("text"), body: z6.string(), terminal: z6.boolean() }),
       // Runtime/provider-authored prose about the turn — a failure's explanation, or a line the
       // harness wrote on a turn it recovered. Not the agent's words: the pump persists it as
       // `runtime_notice`, drawn in the SystemNote voice. Adapters emit it only from positive runtime
       // evidence; the web never classifies English strings.
-      z7.object({ type: z7.literal("runtime_notice"), body: z7.string() }),
+      z6.object({ type: z6.literal("runtime_notice"), body: z6.string() }),
       // A tool-activity transition. `name` is prefix-stripped (`cabane_read`, not
       // `mcp__cabane__cabane_read`); `summary` is the short card label; `phase` pairs `start` with a
       // later `done`/`error` on the same `id`.
@@ -1795,15 +1762,15 @@ var init_turn_event = __esm({
       // log are a consumer concern (docs/turn-protocol.md). `mcpServer` is the MCP server the call
       // came from (`cabane`, `playwright`, …), derived before `name` dropped the prefix; null for a
       // host tool. Optional, read as null when absent.
-      z7.object({
-        type: z7.literal("tool"),
-        id: z7.string(),
-        name: z7.string(),
-        phase: z7.enum(["start", "done", "error"]),
-        summary: z7.string(),
-        input: z7.unknown().optional(),
-        result: z7.unknown().optional(),
-        mcpServer: z7.string().nullable().optional()
+      z6.object({
+        type: z6.literal("tool"),
+        id: z6.string(),
+        name: z6.string(),
+        phase: z6.enum(["start", "done", "error"]),
+        summary: z6.string(),
+        input: z6.unknown().optional(),
+        result: z6.unknown().optional(),
+        mcpServer: z6.string().nullable().optional()
       }),
       // The turn's terminal outcome. `ok:false` carries a machine reason (`no_session`, an error
       // code), surfaced by the host's clear-PATCH as `errorReason`.
@@ -1824,48 +1791,48 @@ var init_turn_event = __esm({
       // started with); `resolvedConfig` the knobs the harness reported (`{ reasoningEffort }` for
       // codex). Known only after the run streams, so they ride this event home and the host relays
       // them on settle. A cancel has no result event at all.
-      z7.object({
-        type: z7.literal("result"),
-        ok: z7.boolean(),
-        reason: z7.string().optional(),
-        usage: z7.object({
-          inputTokens: z7.number(),
-          outputTokens: z7.number(),
-          cacheReadTokens: z7.number().optional(),
-          cacheCreationTokens: z7.number().optional(),
-          contextTokens: z7.number().optional(),
-          contextWindow: z7.number().optional(),
+      z6.object({
+        type: z6.literal("result"),
+        ok: z6.boolean(),
+        reason: z6.string().optional(),
+        usage: z6.object({
+          inputTokens: z6.number(),
+          outputTokens: z6.number(),
+          cacheReadTokens: z6.number().optional(),
+          cacheCreationTokens: z6.number().optional(),
+          contextTokens: z6.number().optional(),
+          contextWindow: z6.number().optional(),
           // The rest of the harness's context reading, when it gave one: where it will compact, its
           // `/context` breakdown, and every compaction it reported. Claude Code only.
-          contextCompactAt: z7.number().optional(),
-          contextCategories: z7.array(
-            z7.object({
-              name: z7.string(),
-              tokens: z7.number(),
-              kind: z7.enum(["used", "free", "buffer", "deferred"])
+          contextCompactAt: z6.number().optional(),
+          contextCategories: z6.array(
+            z6.object({
+              name: z6.string(),
+              tokens: z6.number(),
+              kind: z6.enum(["used", "free", "buffer", "deferred"])
             })
           ).optional(),
-          contextCompactions: z7.array(
-            z7.object({
-              trigger: z7.enum(["manual", "auto"]),
-              preTokens: z7.number(),
-              postTokens: z7.number().optional()
+          contextCompactions: z6.array(
+            z6.object({
+              trigger: z6.enum(["manual", "auto"]),
+              preTokens: z6.number(),
+              postTokens: z6.number().optional()
             })
           ).optional()
         }).optional(),
-        resolvedModel: z7.string().optional(),
-        resolvedConfig: z7.object({
-          effort: z7.string().optional(),
-          thinking: z7.string().optional(),
-          reasoningEffort: z7.string().optional()
+        resolvedModel: z6.string().optional(),
+        resolvedConfig: z6.object({
+          effort: z6.string().optional(),
+          thinking: z6.string().optional(),
+          reasoningEffort: z6.string().optional()
         }).optional(),
         // The harness-reported MCP inventory from this turn's init frame. Diagnostic only: names,
         // statuses and a count — never server definitions, credentials or session ids.
         // `initReceived:false` tells a missing init frame from a real empty inventory.
-        mcpInventory: z7.object({
-          initReceived: z7.boolean(),
-          servers: z7.array(z7.object({ name: z7.string(), status: z7.string() })),
-          toolCount: z7.number().int().nonnegative()
+        mcpInventory: z6.object({
+          initReceived: z6.boolean(),
+          servers: z6.array(z6.object({ name: z6.string(), status: z6.string() })),
+          toolCount: z6.number().int().nonnegative()
         }).optional()
       })
     ]);
@@ -1873,27 +1840,27 @@ var init_turn_event = __esm({
 });
 
 // packages/agent-runtime/src/turn-diagnostics.ts
-import { z as z8 } from "zod";
+import { z as z7 } from "zod";
 var turnResultReasonSchema, turnOutcomes, turnSessionModes, turnRuntimeResultKinds, turnFinalSources, turnDiagnosticsSchema;
 var init_turn_diagnostics = __esm({
   "packages/agent-runtime/src/turn-diagnostics.ts"() {
     "use strict";
-    turnResultReasonSchema = z8.discriminatedUnion("kind", [
-      z8.object({ kind: z8.literal("usage_capped"), resetsAt: z8.string().optional() }),
-      z8.object({ kind: z8.literal("rate_limited") }),
-      z8.object({ kind: z8.literal("server_error") }),
-      z8.object({ kind: z8.literal("auth_expired") }),
-      z8.object({ kind: z8.literal("no_result") }),
-      z8.object({ kind: z8.literal("empty_result") }),
-      z8.object({ kind: z8.literal("empty_result_unverified") }),
-      z8.object({ kind: z8.literal("timeout_idle") }),
-      z8.object({ kind: z8.literal("timeout_total") }),
-      z8.object({ kind: z8.literal("cancelled") }),
-      z8.object({ kind: z8.literal("lease_lost") }),
-      z8.object({ kind: z8.literal("skipped") }),
-      z8.object({ kind: z8.literal("session_start_failed") }),
-      z8.object({ kind: z8.literal("workspace_tools_missing") }),
-      z8.object({ kind: z8.literal("runtime_error") })
+    turnResultReasonSchema = z7.discriminatedUnion("kind", [
+      z7.object({ kind: z7.literal("usage_capped"), resetsAt: z7.string().optional() }),
+      z7.object({ kind: z7.literal("rate_limited") }),
+      z7.object({ kind: z7.literal("server_error") }),
+      z7.object({ kind: z7.literal("auth_expired") }),
+      z7.object({ kind: z7.literal("no_result") }),
+      z7.object({ kind: z7.literal("empty_result") }),
+      z7.object({ kind: z7.literal("empty_result_unverified") }),
+      z7.object({ kind: z7.literal("timeout_idle") }),
+      z7.object({ kind: z7.literal("timeout_total") }),
+      z7.object({ kind: z7.literal("cancelled") }),
+      z7.object({ kind: z7.literal("lease_lost") }),
+      z7.object({ kind: z7.literal("skipped") }),
+      z7.object({ kind: z7.literal("session_start_failed") }),
+      z7.object({ kind: z7.literal("workspace_tools_missing") }),
+      z7.object({ kind: z7.literal("runtime_error") })
     ]);
     turnOutcomes = ["success", "failure", "cancelled", "skipped"];
     turnSessionModes = ["fresh", "resumed", "degraded"];
@@ -1905,25 +1872,25 @@ var init_turn_diagnostics = __esm({
       "marker",
       "none"
     ];
-    turnDiagnosticsSchema = z8.object({
-      outcome: z8.enum(turnOutcomes),
+    turnDiagnosticsSchema = z7.object({
+      outcome: z7.enum(turnOutcomes),
       resultReason: turnResultReasonSchema.nullable(),
-      sessionMode: z8.enum(turnSessionModes),
-      sessionFingerprint: z8.string().regex(/^[a-f0-9]{16}$/).nullable(),
-      eventCounts: z8.object({
-        session: z8.number().int().nonnegative(),
-        text: z8.number().int().nonnegative(),
-        runtime_notice: z8.number().int().nonnegative(),
-        thinking: z8.number().int().nonnegative(),
-        tool: z8.number().int().nonnegative(),
-        result: z8.number().int().nonnegative()
+      sessionMode: z7.enum(turnSessionModes),
+      sessionFingerprint: z7.string().regex(/^[a-f0-9]{16}$/).nullable(),
+      eventCounts: z7.object({
+        session: z7.number().int().nonnegative(),
+        text: z7.number().int().nonnegative(),
+        runtime_notice: z7.number().int().nonnegative(),
+        thinking: z7.number().int().nonnegative(),
+        tool: z7.number().int().nonnegative(),
+        result: z7.number().int().nonnegative()
       }),
-      runtimeResultKind: z8.enum(turnRuntimeResultKinds).nullable(),
-      finalSource: z8.enum(turnFinalSources),
-      mcpInventory: z8.object({
-        initReceived: z8.boolean(),
-        servers: z8.array(z8.object({ name: z8.string(), status: z8.string() })),
-        toolCount: z8.number().int().nonnegative()
+      runtimeResultKind: z7.enum(turnRuntimeResultKinds).nullable(),
+      finalSource: z7.enum(turnFinalSources),
+      mcpInventory: z7.object({
+        initReceived: z7.boolean(),
+        servers: z7.array(z7.object({ name: z7.string(), status: z7.string() })),
+        toolCount: z7.number().int().nonnegative()
       }).optional()
     });
   }
@@ -1997,105 +1964,106 @@ var init_empty_result = __esm({
 });
 
 // packages/agent-runtime/src/turn-request.ts
-import { z as z9 } from "zod";
+import { z as z8 } from "zod";
 var contentBlockSchema, effortLevelSchema, resolvedRunConfigSchema, resolvedMcpServerSchema, resolvedMcpServersSchema, hostInjectedServersSchema, turnRequestSchema;
 var init_turn_request = __esm({
   "packages/agent-runtime/src/turn-request.ts"() {
     "use strict";
-    init_host_policy();
-    contentBlockSchema = z9.discriminatedUnion("type", [
-      z9.object({ type: z9.literal("text"), text: z9.string() }),
-      z9.object({
-        type: z9.literal("image"),
-        source: z9.object({ type: z9.literal("url"), url: z9.string() })
+    contentBlockSchema = z8.discriminatedUnion("type", [
+      z8.object({ type: z8.literal("text"), text: z8.string() }),
+      z8.object({
+        type: z8.literal("image"),
+        source: z8.object({ type: z8.literal("url"), url: z8.string() })
       }),
-      z9.object({
-        type: z9.literal("document"),
-        source: z9.object({ type: z9.literal("url"), url: z9.string() })
+      z8.object({
+        type: z8.literal("document"),
+        source: z8.object({ type: z8.literal("url"), url: z8.string() })
       })
     ]);
-    effortLevelSchema = z9.enum(["low", "medium", "high", "xhigh", "max"]);
-    resolvedRunConfigSchema = z9.object({
-      model: z9.string().nullable(),
+    effortLevelSchema = z8.enum(["low", "medium", "high", "xhigh", "max"]);
+    resolvedRunConfigSchema = z8.object({
+      model: z8.string().nullable(),
       effort: effortLevelSchema.optional(),
-      runtimeOptions: z9.record(z9.string(), z9.unknown()).optional()
+      runtimeOptions: z8.record(z8.string(), z8.unknown()).optional()
     });
-    resolvedMcpServerSchema = z9.union([
-      z9.object({
-        type: z9.literal("stdio").optional(),
-        command: z9.string(),
-        args: z9.array(z9.string()).optional(),
-        env: z9.record(z9.string(), z9.string()).optional(),
-        envFromEnv: z9.record(z9.string(), z9.string()).optional()
+    resolvedMcpServerSchema = z8.union([
+      z8.object({
+        type: z8.literal("stdio").optional(),
+        command: z8.string(),
+        args: z8.array(z8.string()).optional(),
+        env: z8.record(z8.string(), z8.string()).optional(),
+        envFromEnv: z8.record(z8.string(), z8.string()).optional()
       }),
-      z9.object({
-        type: z9.literal("http"),
-        url: z9.string(),
-        headers: z9.record(z9.string(), z9.string()).optional(),
-        headersFromEnv: z9.record(z9.string(), z9.string()).optional()
+      z8.object({
+        type: z8.literal("http"),
+        url: z8.string(),
+        headers: z8.record(z8.string(), z8.string()).optional(),
+        headersFromEnv: z8.record(z8.string(), z8.string()).optional()
       }),
-      z9.object({
-        type: z9.literal("sse"),
-        url: z9.string(),
-        headers: z9.record(z9.string(), z9.string()).optional(),
-        headersFromEnv: z9.record(z9.string(), z9.string()).optional()
+      z8.object({
+        type: z8.literal("sse"),
+        url: z8.string(),
+        headers: z8.record(z8.string(), z8.string()).optional(),
+        headersFromEnv: z8.record(z8.string(), z8.string()).optional()
       })
     ]);
-    resolvedMcpServersSchema = z9.record(z9.string(), resolvedMcpServerSchema);
-    hostInjectedServersSchema = z9.record(z9.string(), z9.unknown());
-    turnRequestSchema = z9.object({
+    resolvedMcpServersSchema = z8.record(z8.string(), resolvedMcpServerSchema);
+    hostInjectedServersSchema = z8.record(z8.string(), z8.unknown());
+    turnRequestSchema = z8.object({
       // Server-composed standing instructions: the core segment (body, tool naming, identity, agent
       // charter) and, after it, the conversation segment (workspace and room charters, skill indexes,
       // roster). One string to the adapter, current as of this dispatch.
-      systemPrompt: z9.string(),
+      systemPrompt: z8.string(),
       // The same text as its two ordered segments, so an adapter that writes standing text into the
       // conversation (Codex's input preamble) can tell which half changed. `systemPrompt` is
       // `joinStanding(standing)`. Optional: absent from an API older than the split, where
       // `systemPrompt` is the core alone and the conversation material rides `prompt`.
-      standing: z9.object({ core: z9.string(), conversation: z9.string() }).optional(),
+      standing: z8.object({ core: z8.string(), conversation: z8.string() }).optional(),
       // Server-composed per-turn user text (anchor reminder + the triggering message).
-      prompt: z9.string(),
+      prompt: z8.string(),
       // The multi-block user-message body (text + vision).
-      content: z9.array(contentBlockSchema),
+      content: z8.array(contentBlockSchema),
       // Portable-or-dialect run-config (above).
       config: resolvedRunConfigSchema,
-      // Abstract capability grants; the adapter maps them to tool names.
-      policy: hostPolicySchema,
       // Prior opaque session state, or null for a fresh session.
-      session: z9.string().nullable(),
+      session: z8.string().nullable(),
       // The cabane control-plane coordinates for this turn's MCP + post-back.
-      cabane: z9.object({
-        mcpUrl: z9.string(),
-        bearer: z9.string(),
-        activeConversationId: z9.string(),
+      cabane: z8.object({
+        mcpUrl: z8.string(),
+        bearer: z8.string(),
+        activeConversationId: z8.string(),
         // Scoped turn-control MCP URL. Codex and opencode mount it as `cabane_companion` with the bearer
         // and active-conversation header, for ask, withdraw_ask, wake_me, cancel_wake and skip_turn.
         // Claude Code mounts the companion's in-process instance instead. Optional; the companion
         // populates it.
-        turnControlUrl: z9.string().optional(),
+        turnControlUrl: z8.string().optional(),
         // Workspace coordinate retained for envelope compatibility. Current
         // adapters use MCP, whose workspace operations take workspaceId explicitly.
         // The companion supplies this field; it is not required by those adapters.
-        workspaceId: z9.string().optional()
+        workspaceId: z8.string().optional()
       }),
       // Machine-local resolution (host-filled): the checkout cwd, extra env from a
       // prepare hook, and the resolved user MCP servers.
-      local: z9.object({
-        cwd: z9.string().optional(),
-        env: z9.record(z9.string(), z9.string()).optional(),
+      local: z8.object({
+        cwd: z8.string().optional(),
+        env: z8.record(z8.string(), z8.string()).optional(),
         mcpServers: resolvedMcpServersSchema.optional(),
         // The values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` → complete header value). The
         // adapter merges them into the harness process's environment and nowhere else; the host never
         // merges them into its own. Absent when no server references one.
-        secretEnv: z9.record(z9.string(), z9.string()).optional(),
+        secretEnv: z8.record(z8.string(), z8.string()).optional(),
         // Machine-local claude-code knobs for an operator running their own companion — the auto-memory
         // escape hatch. `autoMemory: true` opts back into Claude Code's auto-memory (governed by the
         // operator's `.claude/settings.json`); absent/false keeps the adapter's force-off default
         // (`buildClaudeCodeOptions`).
-        claudeCode: z9.object({ autoMemory: z9.boolean().optional() }).optional()
+        claudeCode: z8.object({ autoMemory: z8.boolean().optional() }).optional(),
+        // Machine-local Codex facts the host read before the turn. `configSetsSandboxMode`: the
+        // person's own Codex `config.toml` names a `sandbox_mode`, so the adapter passes no sandbox
+        // flag and the file governs (`codexSandboxMode`). Absent/false → `danger-full-access`.
+        codex: z8.object({ configSetsSandboxMode: z8.boolean().optional() }).optional()
       }),
       // Host-owned injected servers (host-filled).
-      extra: z9.object({
+      extra: z8.object({
         mcpServers: hostInjectedServersSchema
       })
     });
@@ -2119,18 +2087,18 @@ var init_standing = __esm({
 });
 
 // packages/agent-runtime/src/conformance.ts
-import { z as z10 } from "zod";
+import { z as z9 } from "zod";
 var conformanceFixtureSchema;
 var init_conformance = __esm({
   "packages/agent-runtime/src/conformance.ts"() {
     "use strict";
     init_turn_event();
     init_turn_request();
-    conformanceFixtureSchema = z10.object({
-      name: z10.string(),
+    conformanceFixtureSchema = z9.object({
+      name: z9.string(),
       request: turnRequestSchema,
-      nativeStream: z10.array(z10.unknown()),
-      expected: z10.array(turnEventSchema)
+      nativeStream: z9.array(z9.unknown()),
+      expected: z9.array(turnEventSchema)
     });
   }
 });
@@ -2627,13 +2595,7 @@ var init_mcp_secret_env = __esm({
 });
 
 // packages/agent-runtime/src/claude-code/policy.ts
-import { z as z11 } from "zod";
-function disallowedToolsFor(policy) {
-  const tools = [...UNSUPPORTED_TOOLS, ...STRANDING_TOOLS];
-  if (!policy.subagents) tools.unshift(...SUBAGENT_TOOLS);
-  if (!policy.hostFs) tools.unshift(...HOST_FS_TOOLS);
-  return tools;
-}
+import { z as z10 } from "zod";
 function withThinkingSummaries(thinking) {
   if (!thinking) return { type: "adaptive", display: "summarized" };
   if (thinking.type === "disabled") return thinking;
@@ -2645,27 +2607,10 @@ function readThinking(runtimeOptions) {
   if (!parsed.success) return void 0;
   return parsed.data.thinking;
 }
-var HOST_FS_TOOLS, SUBAGENT_TOOLS, UNSUPPORTED_TOOLS, STRANDING_TOOLS, DEFAULT_WEB_TOOLS, claudeCodeDialectSchema;
+var SUBAGENT_TOOLS, UNSUPPORTED_TOOLS, STRANDING_TOOLS, DEFAULT_WEB_TOOLS, claudeCodeDialectSchema;
 var init_policy = __esm({
   "packages/agent-runtime/src/claude-code/policy.ts"() {
     "use strict";
-    HOST_FS_TOOLS = [
-      // shell + local filesystem
-      "Bash",
-      "Read",
-      "Write",
-      "Edit",
-      "Glob",
-      "Grep",
-      // notebook tools (host-fs, Jupyter) — same host reach as Read/Write/Edit
-      "NotebookEdit",
-      "NotebookRead",
-      // git-worktree manipulation on the host checkout
-      "EnterWorktree",
-      "ExitWorktree",
-      // host code execution
-      "REPL"
-    ];
     SUBAGENT_TOOLS = ["Task", "Agent"];
     UNSUPPORTED_TOOLS = ["AskUserQuestion"];
     STRANDING_TOOLS = [
@@ -2687,18 +2632,18 @@ var init_policy = __esm({
       "Workflow"
     ];
     DEFAULT_WEB_TOOLS = ["WebSearch", "WebFetch"];
-    claudeCodeDialectSchema = z11.object({
-      thinking: z11.discriminatedUnion("type", [
-        z11.object({
-          type: z11.literal("adaptive"),
-          display: z11.enum(["summarized", "omitted"]).optional()
+    claudeCodeDialectSchema = z10.object({
+      thinking: z10.discriminatedUnion("type", [
+        z10.object({
+          type: z10.literal("adaptive"),
+          display: z10.enum(["summarized", "omitted"]).optional()
         }),
-        z11.object({
-          type: z11.literal("enabled"),
-          budgetTokens: z11.number().int().positive().optional(),
-          display: z11.enum(["summarized", "omitted"]).optional()
+        z10.object({
+          type: z10.literal("enabled"),
+          budgetTokens: z10.number().int().positive().optional(),
+          display: z10.enum(["summarized", "omitted"]).optional()
         }),
-        z11.object({ type: z11.literal("disabled") })
+        z10.object({ type: z10.literal("disabled") })
       ]).optional()
     }).loose();
   }
@@ -2766,13 +2711,13 @@ async function preToolUseHook(input) {
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
       permissionDecision: "allow",
-      permissionDecisionReason: "coding mode: headless never-prompt (CT680)",
+      permissionDecisionReason: "headless never-prompt (CT680)",
       updatedInput: toolInput
     }
   };
 }
 function buildClaudeCodeOptions(req, augment) {
-  const { policy, config } = req;
+  const { config } = req;
   const cwd = req.local.cwd;
   const userServers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
@@ -2805,15 +2750,10 @@ function buildClaudeCodeOptions(req, augment) {
       alwaysLoad: true
     };
   }
-  const useCodingPreset = policy.hostFs;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
-  const allowedTools = dedupe([
-    cabaneGlob,
-    ...extraServerGlobs,
-    ...policy.web ? DEFAULT_WEB_TOOLS : []
-  ]);
-  const disallowedTools = dedupe([...disallowedToolsFor(policy)]);
+  const allowedTools = dedupe([cabaneGlob, ...extraServerGlobs, ...DEFAULT_WEB_TOOLS]);
+  const disallowedTools = dedupe([...UNSUPPORTED_TOOLS, ...STRANDING_TOOLS]);
   const resumeDecision = decideResume(req.session, cwd);
   const resume = "resume" in resumeDecision ? resumeDecision.resume : null;
   const freshReason = "fresh" in resumeDecision ? resumeDecision.reason : void 0;
@@ -2831,9 +2771,7 @@ function buildClaudeCodeOptions(req, augment) {
     // (`runtimeOptions['claude-code']`).
     thinking: withThinkingSummaries(readThinking(config.runtimeOptions)),
     ...config.effort ? { effort: config.effort } : {},
-    // Never merge arbitrary user `~/.claude` config; without `strictMcpConfig` the
-    // user's existing `cabane` MCP registration could shadow ours.
-    settingSources: [],
+    // Without `strictMcpConfig` the user's existing `cabane` MCP registration could shadow ours.
     strictMcpConfig: true,
     // Auto-memory off unless the operator opted back in (see above).
     ...devControlsAutoMemory ? {} : { settings: { autoMemoryEnabled: false } },
@@ -2869,31 +2807,19 @@ function buildClaudeCodeOptions(req, augment) {
     },
     ...resume ? { resume } : {}
   };
-  let options;
-  if (useCodingPreset) {
-    options = {
-      ...base,
-      systemPrompt: {
-        type: "preset",
-        preset: "claude_code",
-        append: req.systemPrompt,
-        snapshot: false
-      },
-      settingSources: ["user", "project"],
-      allowedTools,
-      disallowedTools,
-      hooks: { PreToolUse: [{ hooks: [preToolUseHook] }] }
-    };
-  } else {
-    options = {
-      ...base,
-      systemPrompt: { type: "custom", prompt: req.systemPrompt, snapshot: false },
-      allowedTools,
-      disallowedTools,
-      permissionMode: "bypassPermissions",
-      allowDangerouslySkipPermissions: true
-    };
-  }
+  const options = {
+    ...base,
+    systemPrompt: {
+      type: "preset",
+      preset: "claude_code",
+      append: req.systemPrompt,
+      snapshot: false
+    },
+    settingSources: ["user", "project"],
+    allowedTools,
+    disallowedTools,
+    hooks: { PreToolUse: [{ hooks: [preToolUseHook] }] }
+  };
   return { options: augment ? augment(options, req) : options, resume, freshReason };
 }
 function dedupe(xs) {
@@ -3440,7 +3366,6 @@ function makeRequest(overrides2 = {}) {
     content: [{ type: "text", text: "hi there" }],
     // The adapter rejects a null model, so the fixture carries a real bare SDK id.
     config: { model: "claude-opus-4-8" },
-    policy: CABANE_POLICY,
     session: null,
     cabane: { mcpUrl: "https://cabane.test/api/mcp", bearer: "tok", activeConversationId: "conv" },
     local: { cwd: CWD },
@@ -3448,22 +3373,13 @@ function makeRequest(overrides2 = {}) {
     ...overrides2
   };
 }
-var ABORT_SENTINEL, CABANE_POLICY, CWD, HEALTHY_MCP_INVENTORY, init, assistantText, assistantTextTool, toolResult, resultSuccess, resultSuccessFull, resultError, resultErrorFull, rateLimitEvent, authStatus, sessionEvent, BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES, CLAUDE_CODE_CONFORMANCE_FIXTURES;
+var ABORT_SENTINEL, CWD, HEALTHY_MCP_INVENTORY, init, assistantText, assistantTextTool, toolResult, resultSuccess, resultSuccessFull, resultError, resultErrorFull, rateLimitEvent, authStatus, sessionEvent, BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES, CLAUDE_CODE_CONFORMANCE_FIXTURES;
 var init_conformance2 = __esm({
   "packages/agent-runtime/src/claude-code/conformance.ts"() {
     "use strict";
     init_claude_code();
     init_session();
     ABORT_SENTINEL = { __abortHere: true };
-    CABANE_POLICY = {
-      hostFs: false,
-      web: true,
-      browser: false,
-      userMcp: false,
-      subagents: false,
-      scheduling: "never",
-      uiPrompts: "never"
-    };
     CWD = "/env/here";
     HEALTHY_MCP_INVENTORY = {
       initReceived: true,
@@ -4266,43 +4182,25 @@ var init_loop2 = __esm({
 });
 
 // packages/agent-runtime/src/opencode/policy.ts
-import { z as z12 } from "zod";
-function opencodeToolPolicy(policy) {
+import { z as z11 } from "zod";
+function opencodeTools() {
   const tools = {};
-  const deny = (names) => {
-    for (const n of names) tools[n] = false;
-  };
-  if (!policy.hostFs) deny(OPENCODE_HOST_TOOLS);
-  if (!policy.subagents) deny(OPENCODE_SUBAGENT_TOOLS);
-  if (!policy.web) deny(OPENCODE_WEB_TOOLS);
-  deny(OPENCODE_SCHEDULING_TOOLS);
-  deny(OPENCODE_UI_PROMPT_TOOLS);
-  return { tools, allowAllHostTools: policy.hostFs };
+  for (const name of [...OPENCODE_SCHEDULING_TOOLS, ...OPENCODE_UI_PROMPT_TOOLS])
+    tools[name] = false;
+  return tools;
 }
 function readOpencodeDialect(runtimeOptions) {
   const parsed = opencodeDialectSchema.safeParse(runtimeOptions?.["opencode"] ?? {});
   return parsed.success ? parsed.data : {};
 }
-var OPENCODE_HOST_TOOLS, OPENCODE_WEB_TOOLS, OPENCODE_SUBAGENT_TOOLS, OPENCODE_SCHEDULING_TOOLS, OPENCODE_UI_PROMPT_TOOLS, opencodeDialectSchema;
+var OPENCODE_SCHEDULING_TOOLS, OPENCODE_UI_PROMPT_TOOLS, opencodeDialectSchema;
 var init_policy2 = __esm({
   "packages/agent-runtime/src/opencode/policy.ts"() {
     "use strict";
-    OPENCODE_HOST_TOOLS = [
-      "bash",
-      "edit",
-      "write",
-      "read",
-      "grep",
-      "glob",
-      "list",
-      "patch"
-    ];
-    OPENCODE_WEB_TOOLS = ["webfetch"];
-    OPENCODE_SUBAGENT_TOOLS = ["task"];
     OPENCODE_SCHEDULING_TOOLS = [];
     OPENCODE_UI_PROMPT_TOOLS = ["question"];
-    opencodeDialectSchema = z12.object({
-      agent: z12.string().min(1).optional()
+    opencodeDialectSchema = z11.object({
+      agent: z11.string().min(1).optional()
     }).loose();
   }
 });
@@ -4321,18 +4219,16 @@ var init_model2 = __esm({
 
 // packages/agent-runtime/src/opencode/run-spec.ts
 function buildRunSpec(req, resumeSessionId) {
-  const { policy, config } = req;
+  const { config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readOpencodeDialect(config.runtimeOptions);
-  const { tools, allowAllHostTools } = opencodeToolPolicy(policy);
   return {
     resumeSessionId,
     directory,
     model: config.model ? parseOpencodeModel(config.model) : null,
     systemPrompt: req.systemPrompt,
     parts: buildParts(req),
-    tools,
-    allowAllHostTools,
+    tools: opencodeTools(),
     ...dialect.agent ? { agent: dialect.agent } : {},
     mcp: buildMcp(req),
     // Every server this turn installs with a credential resolved into it: a remote one's
@@ -4480,11 +4376,12 @@ function createHttpOpencodeTransport(opts) {
   const doFetch = opts.fetchImpl ?? fetch;
   return {
     async run(spec, signal) {
+      const url = scopedUrl(base, spec.directory);
       const release = await acquireServerTurnLock(base);
       if (signal.aborted) release();
       else signal.addEventListener("abort", release, { once: true });
       try {
-        const eventRes = await doFetch(`${base}/event`, {
+        const eventRes = await doFetch(url("/event"), {
           headers: { accept: "text/event-stream" },
           signal
         });
@@ -4494,7 +4391,7 @@ function createHttpOpencodeTransport(opts) {
         let sessionId = spec.resumeSessionId;
         let created = false;
         if (!sessionId) {
-          const res = await doFetch(`${base}/session`, {
+          const res = await doFetch(url("/session"), {
             method: "POST",
             headers: { "content-type": "application/json" },
             body: JSON.stringify({ body: {} }),
@@ -4506,9 +4403,9 @@ function createHttpOpencodeTransport(opts) {
           sessionId = json.id;
           created = true;
         }
-        await installMcp(doFetch, base, spec, signal);
+        await installMcp(doFetch, url, spec, signal);
         const promptRes = await doFetch(
-          `${base}/session/${encodeURIComponent(sessionId)}/prompt_async`,
+          url(`/session/${encodeURIComponent(sessionId)}/prompt_async`),
           {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -4527,7 +4424,7 @@ function createHttpOpencodeTransport(opts) {
         }
         const sid = sessionId;
         const onAbort = () => {
-          void doFetch(`${base}/session/${encodeURIComponent(sid)}/abort`, {
+          void doFetch(url(`/session/${encodeURIComponent(sid)}/abort`), {
             method: "POST"
           }).catch(() => {
           });
@@ -4539,7 +4436,13 @@ function createHttpOpencodeTransport(opts) {
           created,
           directory: spec.directory,
           // The lock is released when this stream finishes draining.
-          events: releaseAfter(parseSseStream(eventRes.body, sessionId, signal), release)
+          events: releaseAfter(
+            approvePermissions(
+              parseSseStream(eventRes.body, sessionId, signal),
+              (ev) => replyToPermission(doFetch, url, ev, signal)
+            ),
+            release
+          )
         };
       } catch (err) {
         release();
@@ -4555,16 +4458,16 @@ async function* releaseAfter(events, release) {
     release();
   }
 }
-async function installMcp(doFetch, base, spec, signal) {
+async function installMcp(doFetch, url, spec, signal) {
   const [live, configured] = await Promise.all([
-    getJson(doFetch, `${base}/mcp`, signal),
-    getJson(doFetch, `${base}/config`, signal)
+    getJson(doFetch, url("/mcp"), signal),
+    getJson(doFetch, url("/config"), signal)
   ]);
   const operatorOwned = new Set(Object.keys(asRecord2(asRecord2(configured).mcp)));
   const stale = Object.keys(asRecord2(live)).filter(
     (name) => !(name in spec.mcp) && !operatorOwned.has(name)
   );
-  await Promise.all(stale.map((name) => postMcp(doFetch, base, name, SCRUBBED_MCP_CONFIG, signal)));
+  await Promise.all(stale.map((name) => postMcp(doFetch, url, name, SCRUBBED_MCP_CONFIG, signal)));
   const shadowing = (spec.credentialServers ?? []).filter((name) => operatorOwned.has(name));
   if (shadowing.length > 0) {
     throw new Error(
@@ -4572,11 +4475,11 @@ async function installMcp(doFetch, base, spec, signal) {
     );
   }
   await Promise.all(
-    Object.entries(spec.mcp).map(([name, config]) => postMcp(doFetch, base, name, config, signal))
+    Object.entries(spec.mcp).map(([name, config]) => postMcp(doFetch, url, name, config, signal))
   );
 }
-async function postMcp(doFetch, base, name, config, signal) {
-  const res = await doFetch(`${base}/mcp`, {
+async function postMcp(doFetch, url, name, config, signal) {
+  const res = await doFetch(url("/mcp"), {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({ name, config }),
@@ -4640,6 +4543,33 @@ function belongsToSession(ev, sessionId) {
   if (typeof infoSid === "string") return infoSid === sessionId;
   return true;
 }
+async function* approvePermissions(events, reply2) {
+  for await (const ev of events) {
+    if (ev.type === "permission.asked" || ev.type === "permission.v2.asked") await reply2(ev);
+    yield ev;
+  }
+}
+async function replyToPermission(doFetch, url, ev, signal) {
+  const props = asRecord2(ev.properties);
+  const id = typeof props.id === "string" ? props.id : null;
+  const sessionId = typeof props.sessionID === "string" ? props.sessionID : null;
+  if (!id) throw new Error(`opencode: ${ev.type} carried no request id`);
+  const target = ev.type === "permission.v2.asked" && sessionId ? url(
+    `/api/session/${encodeURIComponent(sessionId)}/permission/${encodeURIComponent(id)}/reply`,
+    { unscoped: true }
+  ) : url(`/permission/${encodeURIComponent(id)}/reply`);
+  const res = await doFetch(target, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ reply: "once" }),
+    signal
+  });
+  if (!res.ok) throw new Error(`opencode: permission reply failed (HTTP ${res.status})`);
+}
+function scopedUrl(base, directory) {
+  const scope = directory ? `directory=${encodeURIComponent(directory)}` : "";
+  return (path, opts) => scope && !opts?.unscoped ? `${base}${path}${path.includes("?") ? "&" : "?"}${scope}` : base + path;
+}
 function trimSlash(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
@@ -4737,7 +4667,6 @@ function makeRequest2(overrides2 = {}) {
     prompt: "hi there",
     content: [{ type: "text", text: "hi there" }],
     config: { model: "deepseek/deepseek-chat" },
-    policy: COMPANION_POLICY,
     session: null,
     cabane: { mcpUrl: "https://cabane.test/api/mcp", bearer: "tok", activeConversationId: "conv" },
     local: { cwd: DIR },
@@ -4745,7 +4674,7 @@ function makeRequest2(overrides2 = {}) {
     ...overrides2
   };
 }
-var ABORT_SENTINEL2, NEW_SESSION_ID, BOUNDED_NOTICE, COMPANION_POLICY, DIR, textPart, reasoningPart, toolPart, messageUpdated, echoedUserPart, idle, errored, sessionEvent2, OPENCODE_CONFORMANCE_FIXTURES;
+var ABORT_SENTINEL2, NEW_SESSION_ID, BOUNDED_NOTICE, DIR, textPart, reasoningPart, toolPart, messageUpdated, echoedUserPart, idle, errored, sessionEvent2, OPENCODE_CONFORMANCE_FIXTURES;
 var init_conformance3 = __esm({
   "packages/agent-runtime/src/opencode/conformance.ts"() {
     "use strict";
@@ -4754,15 +4683,6 @@ var init_conformance3 = __esm({
     ABORT_SENTINEL2 = { __abortHere: true };
     NEW_SESSION_ID = "sess_new";
     BOUNDED_NOTICE = "You've hit your usage limit \xB7 ".padEnd(200, "x");
-    COMPANION_POLICY = {
-      hostFs: false,
-      web: true,
-      browser: true,
-      userMcp: true,
-      subagents: false,
-      scheduling: "never",
-      uiPrompts: "never"
-    };
     DIR = "/env/here";
     textPart = (id, text) => ({
       type: "message.part.updated",
@@ -5590,23 +5510,9 @@ var init_loop3 = __esm({
 });
 
 // packages/agent-runtime/src/codex/policy.ts
-import { z as z13 } from "zod";
-function codexToolPolicy(policy) {
-  return policy.hostFs ? {
-    sandboxMode: "danger-full-access",
-    // Headless: nothing to approve, because nothing is denied.
-    approvalPolicy: "never",
-    // Full access means the command network is open regardless of the grant —
-    // recorded as `true` so the value never claims a restriction that isn't
-    // enforced.
-    networkAccessEnabled: true
-  } : {
-    sandboxMode: "read-only",
-    // Headless: the sandbox is the boundary; never pause for a human.
-    approvalPolicy: "never",
-    // Retained in the policy value for symmetry; read-only ignores it.
-    networkAccessEnabled: policy.web
-  };
+import { z as z12 } from "zod";
+function codexSandboxMode(local) {
+  return local.codex?.configSetsSandboxMode ? null : "danger-full-access";
 }
 function readCodexDialect(runtimeOptions) {
   const parsed = codexDialectSchema.safeParse(runtimeOptions?.["codex"] ?? {});
@@ -5617,8 +5523,8 @@ var init_policy3 = __esm({
   "packages/agent-runtime/src/codex/policy.ts"() {
     "use strict";
     CODEX_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
-    codexDialectSchema = z13.object({
-      modelReasoningEffort: z13.enum(CODEX_REASONING_EFFORTS).optional()
+    codexDialectSchema = z12.object({
+      modelReasoningEffort: z12.enum(CODEX_REASONING_EFFORTS).optional()
     }).loose();
   }
 });
@@ -5638,11 +5544,10 @@ var init_model3 = __esm({
 });
 
 // packages/agent-runtime/src/codex/run-spec.ts
-function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadStanding = null, imagePaths = []) {
-  const { policy, config } = req;
+function buildRunSpec2(req, resumeThreadId, threadStanding = null, imagePaths = []) {
+  const { config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
-  const baseInstructionsFile = !policy.hostFs && instructionsFile ? instructionsFile : null;
   const model = config.model ? parseCodexModel(config.model) : null;
   const segments = standingSegments(req);
   const conversationText = segments.conversation.trim();
@@ -5652,25 +5557,24 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadStand
   };
   const resumed = resumeThreadId !== null;
   const held = resumed ? threadStanding : null;
-  const viaInput = baseInstructionsFile === null;
   const preamble = {
-    core: viaInput && (held?.core ?? null) !== fingerprints.core,
+    core: (held?.core ?? null) !== fingerprints.core,
     // Compared both ways: a held segment that is now empty differs from it, and nothing held
     // equals nothing to send.
-    conversation: viaInput && (held?.conversation ?? null) !== fingerprints.conversation
+    conversation: (held?.conversation ?? null) !== fingerprints.conversation
   };
   return {
     resumeThreadId,
     directory,
     model,
-    policy: codexToolPolicy(policy),
+    sandboxMode: codexSandboxMode(req.local),
+    approvalPolicy: "never",
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
-    baseInstructionsFile,
     input: withImages(buildInput(req, segments, preamble, resumed), imagePaths),
     preamble,
     fingerprints,
-    config: buildConfig(req, baseInstructionsFile),
+    config: buildConfig(req),
     secretEnv: codexSecretEnv(req)
   };
 }
@@ -5713,7 +5617,7 @@ function withImages(text, imagePaths) {
     ...imagePaths.map((path) => ({ type: "local_image", path }))
   ];
 }
-function buildConfig(req, baseInstructionsFile) {
+function buildConfig(req) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
@@ -5779,9 +5683,6 @@ function buildConfig(req, baseInstructionsFile) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
-    // The no-host-access prompt replacement — Cabane's composed prompt becomes Codex's base
-    // instructions, and Codex's environment preamble goes with the harness prompt it belonged to.
-    ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {}
   };
 }
@@ -5804,8 +5705,7 @@ var init_run_spec2 = __esm({
       "CABANE_PLAYGROUND_BIN",
       "CABANE_CONVERSATION_ID",
       "CABANE_AGENT_ID",
-      "CABANE_CONVERSATION_TITLE",
-      "CABANE_HOST_ACCESS"
+      "CABANE_CONVERSATION_TITLE"
     ];
     CORE_REPLACES = "Your standing instructions changed since an earlier copy in this conversation, or that copy may have been compacted away. This copy replaces every earlier one: where they differ, this one holds, and anything an earlier copy said that this one does not no longer applies.";
     CONVERSATION_REPLACES = "This conversation's standing context \u2014 its charters, skill indexes and roster \u2014 changed since an earlier copy in this conversation, or that copy may have been compacted away. This copy replaces every earlier one, including charters and skills an earlier turn carried in its own text: where they differ, this one holds, and anything an earlier copy said that this one does not no longer applies.";
@@ -5884,10 +5784,10 @@ import {
 function buildSdkThreadOptions(spec) {
   return {
     ...spec.model ? { model: spec.model } : {},
-    sandboxMode: spec.policy.sandboxMode,
+    ...spec.sandboxMode ? { sandboxMode: spec.sandboxMode } : {},
     workingDirectory: spec.directory,
     skipGitRepoCheck: spec.skipGitRepoCheck,
-    approvalPolicy: spec.policy.approvalPolicy,
+    approvalPolicy: spec.approvalPolicy,
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
@@ -5989,23 +5889,6 @@ function createCodexAdapter(deps = {}) {
           );
         }
       }
-      let instructions = null;
-      if (!req.policy.hostFs) {
-        if (!deps.writeInstructionsFile) {
-          deps.onWarn?.(
-            "codex adapter: no instructions-file writer wired on this host \u2014 the composed prompt rides as the input preamble, so Codex keeps its own base instructions (CT871)"
-          );
-        } else {
-          try {
-            instructions = await deps.writeInstructionsFile(req.systemPrompt);
-          } catch (err) {
-            deps.onWarn?.(
-              "codex adapter: failed to write the per-turn instructions file \u2014 falling back to the input preamble (CT871)",
-              { err: err instanceof Error ? err.message : String(err) }
-            );
-          }
-        }
-      }
       let images = null;
       try {
         const imageUrls = req.content.flatMap((b) => b.type === "image" ? [b.source.url] : []);
@@ -6029,13 +5912,7 @@ function createCodexAdapter(deps = {}) {
           }
           if (signal.aborted) return;
         }
-        const spec = buildRunSpec2(
-          req,
-          resumeThreadId,
-          instructions?.path ?? null,
-          threadStanding,
-          images?.paths ?? []
-        );
+        const spec = buildRunSpec2(req, resumeThreadId, threadStanding, images?.paths ?? []);
         if (spec.model === null) {
           deps.onWarn?.("Codex is using its default model because no model was resolved", {
             model: req.config.model
@@ -6077,15 +5954,6 @@ function createCodexAdapter(deps = {}) {
             });
           }
         }
-        if (instructions) {
-          try {
-            await instructions.cleanup();
-          } catch (err) {
-            deps.onWarn?.("codex adapter: instructions-file cleanup failed (CT871)", {
-              err: err instanceof Error ? err.message : String(err)
-            });
-          }
-        }
       }
     }
   };
@@ -6122,7 +5990,6 @@ function makeRequest3(overrides2 = {}) {
     // Behavioural fixtures use the model-less token (no `resolvedModel` emitted); a dedicated capture
     // fixture sets a real model and effort.
     config: { model: null },
-    policy: COMPANION_POLICY2,
     session: null,
     cabane: { mcpUrl: "https://cabane.test/api/mcp", bearer: "tok", activeConversationId: "conv" },
     local: { cwd: DIR2 },
@@ -6130,7 +5997,7 @@ function makeRequest3(overrides2 = {}) {
     ...overrides2
   };
 }
-var ABORT_SENTINEL3, NEW_THREAD_ID, BOUNDED_NOTICE2, COMPANION_POLICY2, DIR2, PROMPT, threadStarted, agentMessage, reasoning, toolFrame, turnCompleted, turnFailed, fatalError, errorItem, OP_SUCCESS, OP_FAILURE, startedSession, closingSession, CODEX_CONFORMANCE_FIXTURES;
+var ABORT_SENTINEL3, NEW_THREAD_ID, BOUNDED_NOTICE2, DIR2, PROMPT, threadStarted, agentMessage, reasoning, toolFrame, turnCompleted, turnFailed, fatalError, errorItem, OP_SUCCESS, OP_FAILURE, startedSession, closingSession, CODEX_CONFORMANCE_FIXTURES;
 var init_conformance4 = __esm({
   "packages/agent-runtime/src/codex/conformance.ts"() {
     "use strict";
@@ -6139,15 +6006,6 @@ var init_conformance4 = __esm({
     ABORT_SENTINEL3 = { __abortHere: true };
     NEW_THREAD_ID = "th_new";
     BOUNDED_NOTICE2 = "You've hit your usage limit \xB7 ".padEnd(200, "x");
-    COMPANION_POLICY2 = {
-      hostFs: false,
-      web: true,
-      browser: true,
-      userMcp: true,
-      subagents: false,
-      scheduling: "never",
-      uiPrompts: "never"
-    };
     DIR2 = "/env/here";
     PROMPT = "system";
     threadStarted = (threadId) => ({
@@ -7063,7 +6921,6 @@ var init_src = __esm({
   "packages/agent-runtime/src/index.ts"() {
     "use strict";
     init_version();
-    init_host_policy();
     init_turn_event();
     init_turn_diagnostics();
     init_turn_diagnostics_normalize();
@@ -7444,7 +7301,7 @@ var init_turn_containment = __esm({
 });
 
 // src/run-config.ts
-import { z as z14 } from "zod";
+import { z as z13 } from "zod";
 function parseRunConfig(raw, onWarn) {
   const result = runConfigSchema.safeParse(raw ?? {});
   if (result.success) return result.data;
@@ -7457,48 +7314,43 @@ var mcpStdioServerSchema, mcpHttpServerSchema, mcpSseServerSchema, mcpServerDefS
 var init_run_config = __esm({
   "src/run-config.ts"() {
     "use strict";
-    mcpStdioServerSchema = z14.object({
-      type: z14.literal("stdio").optional(),
-      command: z14.string().min(1),
-      args: z14.array(z14.string()).optional(),
-      env: z14.record(z14.string(), z14.string()).optional(),
+    mcpStdioServerSchema = z13.object({
+      type: z13.literal("stdio").optional(),
+      command: z13.string().min(1),
+      args: z13.array(z13.string()).optional(),
+      env: z13.record(z13.string(), z13.string()).optional(),
       // Variable → the name of a `secretEnv` entry holding its value. Set by the server on a
       // room's shared browser, whose connect URL is a credential.
-      envFromEnv: z14.record(z14.string(), z14.string()).optional()
+      envFromEnv: z13.record(z13.string(), z13.string()).optional()
     });
-    mcpHttpServerSchema = z14.object({
-      type: z14.literal("http"),
-      url: z14.string().url(),
-      headers: z14.record(z14.string(), z14.string()).optional(),
+    mcpHttpServerSchema = z13.object({
+      type: z13.literal("http"),
+      url: z13.string().url(),
+      headers: z13.record(z13.string(), z13.string()).optional(),
       // Header → the name of a `secretEnv` entry holding its value. Set by
       // the server on a room connection's entry, and by `resolveMcpSecrets` on a
       // header whose `${VAR}` it resolved.
-      headersFromEnv: z14.record(z14.string(), z14.string()).optional()
+      headersFromEnv: z13.record(z13.string(), z13.string()).optional()
     });
-    mcpSseServerSchema = z14.object({
-      type: z14.literal("sse"),
-      url: z14.string().url(),
-      headers: z14.record(z14.string(), z14.string()).optional(),
+    mcpSseServerSchema = z13.object({
+      type: z13.literal("sse"),
+      url: z13.string().url(),
+      headers: z13.record(z13.string(), z13.string()).optional(),
       // Header → the name of a `secretEnv` entry holding its value. Set by
       // the server on a room connection's entry, and by `resolveMcpSecrets` on a
       // header whose `${VAR}` it resolved.
-      headersFromEnv: z14.record(z14.string(), z14.string()).optional()
+      headersFromEnv: z13.record(z13.string(), z13.string()).optional()
     });
-    mcpServerDefSchema = z14.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
-    thinkingConfigSchema = z14.discriminatedUnion("type", [
-      z14.object({ type: z14.literal("adaptive") }),
-      z14.object({ type: z14.literal("enabled"), budgetTokens: z14.number().int().positive().optional() }),
-      z14.object({ type: z14.literal("disabled") })
+    mcpServerDefSchema = z13.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
+    thinkingConfigSchema = z13.discriminatedUnion("type", [
+      z13.object({ type: z13.literal("adaptive") }),
+      z13.object({ type: z13.literal("enabled"), budgetTokens: z13.number().int().positive().optional() }),
+      z13.object({ type: z13.literal("disabled") })
     ]);
-    effortSchema = z14.enum(["low", "medium", "high", "xhigh", "max"]);
-    runConfigSchema = z14.object({
-      // `true` grants the host filesystem/shell; absent is the locked surface. Kept
-      // in lockstep with `@cabane/shared`'s
-      // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
-      // stripped, so an older companion riding a newer server never rejects the config).
-      hostAccess: z14.boolean().optional(),
-      mcpServers: z14.record(z14.string(), mcpServerDefSchema).optional(),
-      model: z14.string().min(1).optional(),
+    effortSchema = z13.enum(["low", "medium", "high", "xhigh", "max"]);
+    runConfigSchema = z13.object({
+      mcpServers: z13.record(z13.string(), mcpServerDefSchema).optional(),
+      model: z13.string().min(1).optional(),
       thinking: thinkingConfigSchema.optional(),
       effort: effortSchema.optional()
     });
@@ -7507,7 +7359,7 @@ var init_run_config = __esm({
 });
 
 // src/runner/protocol.ts
-import { z as z15 } from "zod";
+import { z as z14 } from "zod";
 function required(env, name) {
   const value = env[name];
   if (!value) throw new Error(`runner: ${name} is not set`);
@@ -7585,56 +7437,56 @@ var init_protocol = __esm({
       // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
       spec: "CABANE_RUNNER_SPEC"
     };
-    runtimeHealthSchema = z15.object({
-      quotaState: z15.enum(["ok", "limited", "auth_expired", "unknown"]),
-      limitedUntil: z15.string().nullable(),
-      lastError: z15.string().nullable()
+    runtimeHealthSchema = z14.object({
+      quotaState: z14.enum(["ok", "limited", "auth_expired", "unknown"]),
+      limitedUntil: z14.string().nullable(),
+      lastError: z14.string().nullable()
     });
-    runnerSpecSchema = z15.object({
-      deviceId: z15.string().optional(),
+    runnerSpecSchema = z14.object({
+      deviceId: z14.string().optional(),
       // The launcher's boot id: the one its heartbeat carries, so a runner's lease
       // matches the device that holds it.
-      bootId: z15.string(),
-      workspaceId: z15.string(),
-      workspaceSlug: z15.string(),
-      agentId: z15.string(),
-      agentUsername: z15.string(),
-      agentName: z15.string(),
+      bootId: z14.string(),
+      workspaceId: z14.string(),
+      workspaceSlug: z14.string(),
+      agentId: z14.string(),
+      agentUsername: z14.string(),
+      agentName: z14.string(),
       local: localAgentConfigSchema,
       runConfig: runConfigSchema,
       // The device's `root`, resolved by the launcher: the pair directory the turn
       // stands in when nothing else names one lives under it (`work-dir.ts`).
-      workRoot: z15.string(),
-      opencodeServerUrl: z15.string().optional(),
-      claudeCodeAvailable: z15.boolean(),
-      codexAvailable: z15.boolean(),
-      idleTimeoutMs: z15.number().int().positive().optional(),
-      totalTimeoutMs: z15.number().int().positive().optional(),
-      leaseRenewalMs: z15.number().int().positive().optional(),
-      preparingRowDelayMs: z15.number().int().nonnegative().optional(),
+      workRoot: z14.string(),
+      opencodeServerUrl: z14.string().optional(),
+      claudeCodeAvailable: z14.boolean(),
+      codexAvailable: z14.boolean(),
+      idleTimeoutMs: z14.number().int().positive().optional(),
+      totalTimeoutMs: z14.number().int().positive().optional(),
+      leaseRenewalMs: z14.number().int().positive().optional(),
+      preparingRowDelayMs: z14.number().int().nonnegative().optional(),
       // Whether the turn writes a transcript, into the device's own directory
       // (`transcriptsDir()`).
-      transcripts: z15.boolean(),
-      logLevel: z15.string(),
+      transcripts: z14.boolean(),
+      logLevel: z14.string(),
       // The launcher's connector-health observations, by runtime, as of the start.
-      connectorHealth: z15.record(z15.string(), runtimeHealthSchema),
+      connectorHealth: z14.record(z14.string(), runtimeHealthSchema),
       // True when this (conversation, agent) pair was already told its session
       // could not be saved: the notice is once per pair, not once per process.
-      sessionWriteNoticeClaimed: z15.boolean(),
+      sessionWriteNoticeClaimed: z14.boolean(),
       // The runner's identity, minted with its credential. The start
       // PATCH carries it so the lease knows which runner holds the span.
-      runnerId: z15.string()
+      runnerId: z14.string()
     });
-    dispatchSchema = z15.object({
-      type: z15.literal("device:dispatch_requested"),
-      agentId: z15.string(),
-      deviceId: z15.string(),
-      conversationId: z15.string(),
-      messageId: z15.string(),
-      episode: z15.number().int().optional()
+    dispatchSchema = z14.object({
+      type: z14.literal("device:dispatch_requested"),
+      agentId: z14.string(),
+      deviceId: z14.string(),
+      conversationId: z14.string(),
+      messageId: z14.string(),
+      episode: z14.number().int().optional()
     });
-    credentialsSchema = z15.object({
-      credential: z15.string().startsWith("cabrn_")
+    credentialsSchema = z14.object({
+      credential: z14.string().startsWith("cabrn_")
     });
   }
 });
@@ -8030,7 +7882,7 @@ var init_work_dir = __esm({
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z16 } from "zod";
+import { z as z15 } from "zod";
 function createSkipState() {
   return { skipped: false, reason: null };
 }
@@ -8081,7 +7933,7 @@ function createTurnControlMcpServer(acts, skipState) {
           SKIP_TURN_TOOL,
           TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
           {
-            reason: z16.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
+            reason: z15.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
           },
           async (args) => {
             skipState.skipped = true;
@@ -8097,22 +7949,22 @@ function createTurnControlMcpServer(acts, skipState) {
         ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
         {
-          targetUserId: z16.string().regex(ASK_TARGET_PATTERN, { error: ASK_TARGET_INVALID }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
-          question: z16.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
-          headline: z16.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
-          options: z16.array(z16.string({ error: ASK_OPTION_NOT_A_STRING }).min(1).max(MAX_ASK_OPTION_BYTES)).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
-          questions: z16.array(
-            z16.object({
-              headline: z16.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
-              body: z16.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
-              options: z16.array(
-                z16.string({ error: ASK_OPTION_NOT_A_STRING }).min(1).max(MAX_ASK_OPTION_BYTES)
+          targetUserId: z15.string().regex(ASK_TARGET_PATTERN, { error: ASK_TARGET_INVALID }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
+          question: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
+          headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
+          options: z15.array(z15.string({ error: ASK_OPTION_NOT_A_STRING }).min(1).max(MAX_ASK_OPTION_BYTES)).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
+          questions: z15.array(
+            z15.object({
+              headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
+              body: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
+              options: z15.array(
+                z15.string({ error: ASK_OPTION_NOT_A_STRING }).min(1).max(MAX_ASK_OPTION_BYTES)
               ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options"])
             })
           ).min(1).max(MAX_ASK_ITEMS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.questions),
-          replaces: z16.object({
-            askId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
-            reason: z16.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
+          replaces: z15.object({
+            askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
+            reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
           }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.replaces)
         },
         async (args) => {
@@ -8153,9 +8005,9 @@ function createTurnControlMcpServer(acts, skipState) {
         WAKE_ME_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.wake_me,
         {
-          afterSeconds: z16.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
-          at: z16.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
-          note: z16.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
+          afterSeconds: z15.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
+          at: z15.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
+          note: z15.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
         },
         async (args) => {
           const hasAfter = args.afterSeconds !== void 0;
@@ -8189,8 +8041,8 @@ function createTurnControlMcpServer(acts, skipState) {
         WITHDRAW_ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.withdraw_ask,
         {
-          askId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
-          reason: z16.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
+          askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
+          reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
         },
         async (args) => performAct(acts, {
           kind: "withdraw_ask",
@@ -8249,7 +8101,6 @@ function buildCompanionTurnRequest(params) {
     prompt: t.prompt,
     content: t.content,
     config: t.config,
-    policy: t.policy,
     session: t.session,
     cabane: {
       mcpUrl: cabaneMcpUrl(params.baseUrl),
@@ -8266,7 +8117,9 @@ function buildCompanionTurnRequest(params) {
       ...Object.keys(params.mcpServers).length > 0 ? { mcpServers: params.mcpServers } : {},
       ...params.secretEnv && Object.keys(params.secretEnv).length > 0 ? { secretEnv: params.secretEnv } : {},
       // The auto-memory escape hatch, when the operator set it.
-      ...params.claudeCode ? { claudeCode: params.claudeCode } : {}
+      ...params.claudeCode ? { claudeCode: params.claudeCode } : {},
+      // Whether the person's Codex config sets its own sandbox mode.
+      ...params.codex ? { codex: params.codex } : {}
     },
     // Host-injected turn-control tools, under their own namespace.
     extra: {
@@ -8284,42 +8137,49 @@ var init_build_options = __esm({
   }
 });
 
-// src/codex-instructions.ts
-import { mkdtemp, rm, writeFile } from "fs/promises";
-import { tmpdir } from "os";
+// src/codex-config.ts
+import { readFile as readFile2 } from "fs/promises";
+import { homedir as homedir7 } from "os";
 import { join as join15 } from "path";
-async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join15(tmpdir(), PREFIX));
-  const path = join15(dir2, "instructions.md");
-  await writeFile(path, contents, { encoding: "utf8", mode: 384 });
-  return {
-    path,
-    cleanup: async () => {
-      await rm(dir2, { recursive: true, force: true });
-    }
-  };
+import { parse } from "smol-toml";
+function codexConfigPath(env = process.env, home = homedir7()) {
+  return join15(env.CODEX_HOME || join15(home, ".codex"), "config.toml");
+}
+async function readCodexConfigSetsSandboxMode(path = codexConfigPath()) {
+  let text;
+  try {
+    text = await readFile2(path, "utf8");
+  } catch {
+    return false;
+  }
+  return configSetsSandboxMode(text);
+}
+function configSetsSandboxMode(text) {
+  try {
+    return parse(text).sandbox_mode !== void 0;
+  } catch {
+    return false;
+  }
 }
-var PREFIX;
-var init_codex_instructions = __esm({
-  "src/codex-instructions.ts"() {
+var init_codex_config = __esm({
+  "src/codex-config.ts"() {
     "use strict";
-    PREFIX = "cabane-codex-instructions-";
   }
 });
 
 // src/codex-images.ts
-import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
 import { join as join16 } from "path";
 function createCodexImagePreparer(opts) {
   const doFetch = opts.fetch ?? fetch;
   const timeoutMs = opts.timeoutMs ?? FETCH_TIMEOUT_MS;
   return async (urls, signal) => {
     signal.throwIfAborted();
-    const dir2 = await mkdtemp2(join16(tmpdir2(), `cabane-codex-images-${opts.turnId}-`));
+    const dir2 = await mkdtemp(join16(tmpdir(), `cabane-codex-images-${opts.turnId}-`));
     const cleanup = async () => {
       try {
-        await rm2(dir2, { recursive: true, force: true });
+        await rm(dir2, { recursive: true, force: true });
       } catch (err) {
         opts.warn(
           { dir: dir2, err: message(err) },
@@ -8338,7 +8198,7 @@ function createCodexImagePreparer(opts) {
         if (!ext) throw new Error(`not a vision image type: ${type || "none"}`);
         const bytes = new Uint8Array(await res.arrayBuffer());
         const path = join16(dir2, `image-${index + 1}.${ext}`);
-        await writeFile2(path, bytes, { mode: 384 });
+        await writeFile(path, bytes, { mode: 384 });
         return path;
       } catch (err) {
         if (!signal.aborted) {
@@ -8378,10 +8238,10 @@ var init_codex_images = __esm({
 // src/codex-compactions.ts
 import { createReadStream } from "fs";
 import { readdir } from "fs/promises";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { join as join17 } from "path";
 import { createInterface as createInterface2 } from "readline";
-function createCodexCompactionCounter(codexHome = process.env.CODEX_HOME || join17(homedir7(), ".codex")) {
+function createCodexCompactionCounter(codexHome = process.env.CODEX_HOME || join17(homedir8(), ".codex")) {
   return async (threadId) => {
     try {
       const rollout = await findRollout(codexHome, threadId);
@@ -8592,7 +8452,7 @@ var init_prepared = __esm({
 // src/secrets.ts
 import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
 import { join as join19 } from "path";
-import { z as z17 } from "zod";
+import { z as z16 } from "zod";
 function secretsPath() {
   return join19(cabaneDir(), "secrets.json");
 }
@@ -8716,7 +8576,7 @@ var init_secrets = __esm({
     init_config();
     init_errors();
     PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-    secretStoreSchema = z17.record(z17.string(), z17.string());
+    secretStoreSchema = z16.record(z16.string(), z16.string());
     SECRET_ENV_NAME = /^CABANE_MCP_(\d+)$/;
   }
 });
@@ -9100,7 +8960,7 @@ var init_turn_execution = __esm({
     init_work_dir();
     init_build_options();
     init_bundled_binaries();
-    init_codex_instructions();
+    init_codex_config();
     init_codex_images();
     init_codex_compactions();
     init_config();
@@ -9181,6 +9041,7 @@ var init_turn_execution = __esm({
       effectiveCwd;
       hookEnv;
       turnEnv;
+      codexLocal;
       skipState;
       turnControlServer;
       request;
@@ -9522,7 +9383,6 @@ var init_turn_execution = __esm({
                     agentUsername: this.opts.agentUsername,
                     defaultCwd: pairDir,
                     runtime: this.turnContext.runtime,
-                    hostAccess: this.turnContext.policy.hostFs,
                     triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
                     title: this.turnContext.conversation.title,
                     messageBody: this.turnContext.message.body,
@@ -9585,7 +9445,6 @@ var init_turn_execution = __esm({
                   // wants to add to it.
                   defaultCwd: pairDir,
                   runtime: this.turnContext.runtime,
-                  hostAccess: this.turnContext.policy.hostFs,
                   // The trigger message's referenced-entry paths, which a prepare hook
                   // may key its per-task env off. `[]` from an older API.
                   triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
@@ -9618,9 +9477,9 @@ var init_turn_execution = __esm({
         }
         const turnEnv = {
           ...hookEnv,
-          CABANE_HOST_ACCESS: this.turnContext.policy.hostFs ? "1" : "0",
           CABANE_COMPANION_HOME: agentCompanionHome()
         };
+        this.codexLocal = this.turnContext.runtime === "codex" ? { configSetsSandboxMode: await readCodexConfigSetsSandboxMode() } : void 0;
         this.effectiveCwd = effectiveCwd;
         this.hookEnv = hookEnv;
         this.turnEnv = turnEnv;
@@ -9705,7 +9564,8 @@ var init_turn_execution = __esm({
           activeConversationId: payload.conversationId,
           workspaceId,
           // The operator's machine-local auto-memory escape hatch, when set.
-          ...this.opts.local.claudeCode ? { claudeCode: this.opts.local.claudeCode } : {}
+          ...this.opts.local.claudeCode ? { claudeCode: this.opts.local.claudeCode } : {},
+          ...this.codexLocal ? { codex: this.codexLocal } : {}
         });
       }
       integrityContext() {
@@ -9772,7 +9632,6 @@ var init_turn_execution = __esm({
             createCodexAdapter({
               enabled: true,
               onWarn,
-              writeInstructionsFile: writeCodexInstructionsFile,
               prepareImages: createCodexImagePreparer({
                 turnId: this.turnId,
                 warn: (meta, msg) => turnLog.warn(meta, msg)
@@ -12182,7 +12041,6 @@ var CompanionStateHub = class {
           agent_id: a.agentId,
           username: a.username,
           display_name: a.displayName,
-          mode: a.mode,
           has_credential: a.hasCredential,
           missing_secrets: a.missingSecrets
         }))
@@ -13088,7 +12946,7 @@ init_launch();
 // src/manifest.ts
 var DEVICE_MANIFEST = {
   runtimes: [{ name: "claude-code", version: null }],
-  capabilities: { hostFs: true, browser: true, userMcp: true }
+  capabilities: { browser: true, userMcp: true }
 };
 function buildCompanionManifest(opts) {
   const v = opts.versions ?? {};
@@ -13448,27 +13306,27 @@ function compareVersions(a, b) {
 init_config();
 import { mkdirSync as mkdirSync13, readFileSync as readFileSync13, renameSync as renameSync8, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname10, join as join25 } from "path";
-import { z as z18 } from "zod";
-var resultSchema = z18.object({
-  kind: z18.enum(["updated", "rolled_back", "failed"]),
-  from: z18.string(),
-  to: z18.string(),
-  at: z18.string(),
-  reason: z18.string().optional()
+import { z as z17 } from "zod";
+var resultSchema = z17.object({
+  kind: z17.enum(["updated", "rolled_back", "failed"]),
+  from: z17.string(),
+  to: z17.string(),
+  at: z17.string(),
+  reason: z17.string().optional()
 });
-var pendingSchema = z18.object({
-  from: z18.string(),
+var pendingSchema = z17.object({
+  from: z17.string(),
   // The package root `current` pointed at before the swap, so a rollback can point it back.
-  fromRoot: z18.string(),
-  to: z18.string(),
-  at: z18.string(),
-  boots: z18.number().int().nonnegative()
+  fromRoot: z17.string(),
+  to: z17.string(),
+  at: z17.string(),
+  boots: z17.number().int().nonnegative()
 });
-var stateSchema = z18.object({
-  server: z18.object({ latest: z18.string(), minimum: z18.string(), at: z18.string() }).optional(),
+var stateSchema = z17.object({
+  server: z17.object({ latest: z17.string(), minimum: z17.string(), at: z17.string() }).optional(),
   pending: pendingSchema.optional(),
   lastResult: resultSchema.optional(),
-  failed: z18.object({ version: z18.string(), attempts: z18.number().int(), at: z18.string() }).optional()
+  failed: z17.object({ version: z17.string(), attempts: z17.number().int(), at: z17.string() }).optional()
 });
 function updateStatePath(dir2 = cabaneDir()) {
   return join25(dir2, "update.json");
@@ -14365,7 +14223,6 @@ var CompanionSupervisor = class {
           agentId: it.agentId,
           username: it.agentUsername,
           displayName: it.agentDisplayName,
-          mode: runConfig.hostAccess ? "full" : "none",
           hasCredential: false,
           missingSecrets: missing
         });
@@ -14385,7 +14242,6 @@ var CompanionSupervisor = class {
         agentId: it.agentId,
         username: it.agentUsername,
         displayName: it.agentDisplayName,
-        mode: runConfig.hostAccess ? "full" : "none",
         hasCredential: true,
         missingSecrets: missing
       });
@@ -15571,7 +15427,7 @@ import {
   rmSync as rmSync12,
   writeFileSync as writeFileSync10
 } from "fs";
-import { homedir as homedir8, userInfo as userInfo3 } from "os";
+import { homedir as homedir9, userInfo as userInfo3 } from "os";
 import { dirname as dirname12, join as join29, sep as sep3 } from "path";
 function servicePlatform(platform = process.platform) {
   if (platform === "linux") return "systemd";
@@ -15589,7 +15445,7 @@ function launchdLabel(env = process.env) {
 function serviceNode(execPath = process.execPath) {
   return existsSync17(pinnedNodePath()) ? pinnedNodePath() : execPath;
 }
-function servicePaths(platform, env = process.env, home = homedir8(), node = serviceNode()) {
+function servicePaths(platform, env = process.env, home = homedir9(), node = serviceNode()) {
   const unitFile = platform === "systemd" ? join29(
     env.XDG_CONFIG_HOME || join29(home, ".config"),
     "systemd",
@@ -15831,7 +15687,7 @@ async function seedManagedInstall(deps) {
   return { ok: true, root: target };
 }
 function tildeDir() {
-  return cabaneDir().replace(homedir8(), "~");
+  return cabaneDir().replace(homedir9(), "~");
 }
 function unitNode(platform, unitFile) {
   let text;
@@ -16610,7 +16466,7 @@ init_cabane_command();
 init_install_kind();
 init_cabane_command();
 import { readdirSync as readdirSync5, realpathSync as realpathSync6, existsSync as existsSync18 } from "fs";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 import { dirname as dirname13, join as join30 } from "path";
 init_config();
 init_secrets();
@@ -16895,7 +16751,7 @@ function versionLine() {
   const install = companionInstall();
   const own = installedCommandPath({ install });
   if (install === "script") {
-    return `Cabane ${COMPANION_VERSION} \xB7 installed by the install script (${tildePath(join30(homedir9(), ".cabane"))})`;
+    return `Cabane ${COMPANION_VERSION} \xB7 installed by the install script (${tildePath(join30(homedir10(), ".cabane"))})`;
   }
   if (own)
     return `Cabane ${COMPANION_VERSION} \xB7 installed with npm (${tildePath(dirname13(dirname13(own)))})`;
@@ -16922,7 +16778,7 @@ function otherInstall(install, own) {
   };
   if (install === "npm") {
     const script = join30(
-      homedir9(),
+      homedir10(),
       ".cabane",
       "node",
       "lib",
@@ -16930,7 +16786,7 @@ function otherInstall(install, own) {
       "@cabane",
       "companion"
     );
-    return existsSync18(script) ? join30(homedir9(), ".cabane") : null;
+    return existsSync18(script) ? join30(homedir10(), ".cabane") : null;
   }
   const found = firstOnPath("cabane-companion", process.env.PATH);
   if (!found) return null;