@cat-factory/executor-harness 1.86.2 → 1.90.0

package/dist/job.d.ts

@@ -6,6 +6,8 @@ import { type ValidationChecksSpec, type ValidationReport } from './validation-c
 import { type ReproductionReport, type ReproductionSpec } from './reproduction-proof.js';
 import { type DependencyInstallSpec } from './dependency-install.js';
 import { type McpServerSpec, type SkillResourceSpec, type SkillSpec } from './agent-capabilities.js';
+import { type TestSecretSpec } from './job-env.js';
+export type { TestSecretSpec };
 export type { McpServerSpec, SkillResourceSpec, SkillSpec };
 /**
  * Per-job auth fields, shared across every job shape. The Pi harness carries the
@@ -130,23 +132,6 @@ export interface PackageRegistrySpec {
 export declare function allowedNpmRegistryHosts(env?: NodeJS.ProcessEnv): Set<string>;
 /** Validate the optional `packageRegistries` list (see {@link PackageRegistrySpec}). */
 export declare function parsePackageRegistries(value: unknown, env?: NodeJS.ProcessEnv): PackageRegistrySpec[];
-/**
- * One sensitive test credential the tester receives: an env-var name + its (secret) value.
- * The backend seals these at rest and decrypts them at dispatch; the harness injects each as an
- * environment variable the tester's shell can read (out of band — the value is NEVER in the
- * prompt/telemetry). See {@link parseTestSecrets}.
- */
-export interface TestSecretSpec {
-    key: string;
-    value: string;
-}
-/**
- * Validate the optional tester `testSecrets` list — `{ key, value }` env pairs the harness
- * injects into the run environment. Keys must be valid env-var names; toolchain-critical /
- * reserved names ({@link isReservedEnvName}) and duplicates are dropped so a drifted body can't
- * clobber PATH/NODE_OPTIONS/etc. Absent ⇒ no secrets injected.
- */
-export declare function parseTestSecrets(value: unknown): TestSecretSpec[];
 /** The new repository a repo-bootstrap run force-pushes its fresh history to. */
 export interface BootstrapTargetSpec {
     owner: string;
@@ -372,6 +357,16 @@ export interface AgentJob extends HarnessAuthFields {
      * Absent ⇒ no secrets injected.
      */
     testSecrets?: TestSecretSpec[];
+    /**
+     * The resolved credentials of the step's GENERATIVE BINARY INTEGRATIONS (the image / music /
+     * video generation APIs its `binaryOutput` selection named), as env pairs the harness injects
+     * into the agent's own process — where the agent's brief has already told it to read them from.
+     * Distinct from {@link testSecrets} because the two have different producers and different
+     * lifetimes: tester secrets are workspace state a human stored, these are a deployment's
+     * registration resolved per dispatch. Absent ⇒ no integration declared a credential, or none
+     * resolved (which the agent is told to report rather than work around).
+     */
+    generatorSecrets?: TestSecretSpec[];
     /**
      * Explore mode: stand the service's dependencies up before the agent runs (the
      * tester). Brings the docker-compose infra up on localhost for the duration of the
@@ -498,6 +493,8 @@ export interface GuardLimitsSpec {
     maxToolCallsWithoutEdit?: number;
     maxConsecutiveErrors?: number;
     maxConsecutiveWebCalls?: number;
+    maxConsecutiveMcpCalls?: number;
+    maxConsecutiveNonActionCalls?: number;
 }
 /**
  * The record of standing the service's docker-compose dependencies up before a tester

package/dist/job.js

@@ -2,12 +2,7 @@ import { parseValidationChecksSpec, } from './validation-checks.js';
 import { parseReproductionSpec, } from './reproduction-proof.js';
 import { parseDependencyInstallSpec } from './dependency-install.js';
 import { parseMcpServerSpecs, parseSkillSpecs, } from './agent-capabilities.js';
-function str(value, path) {
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new Error(`Invalid job: '${path}' must be a non-empty string`);
-    }
-    return value;
-}
+import { parseInfraEnv, parseSecretEnvPairs, str } from './job-env.js';
 /** A positive finite integer, or undefined for any other input (silently ignored). */
 function posInt(value) {
     return typeof value === 'number' && Number.isFinite(value) && value > 0
@@ -41,12 +36,18 @@ function parseGuardLimits(value) {
     const noEdit = posInt(o.maxToolCallsWithoutEdit);
     const errors = posInt(o.maxConsecutiveErrors);
     const web = posInt(o.maxConsecutiveWebCalls);
+    const mcp = posInt(o.maxConsecutiveMcpCalls);
+    const nonAction = posInt(o.maxConsecutiveNonActionCalls);
     if (noEdit !== undefined)
         spec.maxToolCallsWithoutEdit = noEdit;
     if (errors !== undefined)
         spec.maxConsecutiveErrors = errors;
     if (web !== undefined)
         spec.maxConsecutiveWebCalls = web;
+    if (mcp !== undefined)
+        spec.maxConsecutiveMcpCalls = mcp;
+    if (nonAction !== undefined)
+        spec.maxConsecutiveNonActionCalls = nonAction;
     return Object.keys(spec).length > 0 ? spec : undefined;
 }
 /**
@@ -332,37 +333,6 @@ export function parsePackageRegistries(value, env = process.env) {
     }
     return entries;
 }
-/** A valid POSIX shell variable name (letters, digits, underscore; not starting with a digit). */
-const ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/**
- * Validate the optional tester `testSecrets` list — `{ key, value }` env pairs the harness
- * injects into the run environment. Keys must be valid env-var names; toolchain-critical /
- * reserved names ({@link isReservedEnvName}) and duplicates are dropped so a drifted body can't
- * clobber PATH/NODE_OPTIONS/etc. Absent ⇒ no secrets injected.
- */
-export function parseTestSecrets(value) {
-    if (value === undefined || value === null)
-        return [];
-    if (!Array.isArray(value))
-        throw new Error("Invalid job: 'testSecrets' must be an array");
-    const entries = [];
-    const seen = new Set();
-    for (const [i, raw] of value.entries()) {
-        if (typeof raw !== 'object' || raw === null) {
-            throw new Error(`Invalid job: 'testSecrets[${i}]' must be an object`);
-        }
-        const entry = raw;
-        const key = str(entry.key, `testSecrets[${i}].key`).trim();
-        if (!ENV_VAR_NAME_PATTERN.test(key)) {
-            throw new Error(`Invalid job: 'testSecrets[${i}].key' must be a valid environment variable name`);
-        }
-        if (isReservedEnvName(key) || seen.has(key))
-            continue;
-        seen.add(key);
-        entries.push({ key, value: str(entry.value, `testSecrets[${i}].value`) });
-    }
-    return entries;
-}
 /** Parse the coding-mode bootstrap spec, or undefined when absent. Validates the target. */
 function parseAgentBootstrapSpec(value) {
     if (typeof value !== 'object' || value === null)
@@ -453,64 +423,6 @@ function parseStringMap(value) {
     }
     return Object.keys(out).length ? out : undefined;
 }
-/**
- * Env-var names never injected from a frontend binding: spread over `process.env` at build
- * time, so any of these would break the toolchain (or enable code execution / cert overrides)
- * rather than name an upstream URL. Matched exactly (Linux env is case-sensitive); the
- * {@link RESERVED_ENV_PREFIXES} below cover whole families (`npm_config_*`, `GIT_*`, …).
- */
-const RESERVED_ENV_NAMES = new Set([
-    'PATH',
-    'HOME',
-    'NODE_OPTIONS',
-    'NODE_PATH',
-    'NODE_EXTRA_CA_CERTS',
-    'LD_PRELOAD',
-    'LD_LIBRARY_PATH',
-    'BASH_ENV',
-    'ENV',
-    'SHELL',
-    'IFS',
-]);
-/**
- * Env-var name PREFIXES never injected from a frontend binding. `npm_config_*` reconfigures the
- * package manager (registry, scripts, prefix), and `GIT_*` reconfigures git — both run during a
- * frontend install/build, so a binding in either family is toolchain control, not an upstream URL.
- * Compared case-INSENSITIVELY (lower-cased here, matched lower-cased below): npm reads its config
- * env with a case-insensitive `/^npm_config_/i`, so `NPM_CONFIG_REGISTRY` is honoured just like
- * `npm_config_registry` — a case-sensitive prefix match would let the upper-cased form slip through.
- */
-const RESERVED_ENV_PREFIXES = ['npm_config_', 'git_'];
-/**
- * Whether an env-var name is reserved (an exact name, or a reserved family prefix). The exact
- * names are canonical upper-case env vars matched verbatim (Linux env is case-sensitive, so a
- * distinct lower-cased `home` is a different, harmless var); the family PREFIXES are matched
- * case-insensitively because npm interprets `npm_config_*` regardless of case (see above).
- */
-function isReservedEnvName(key) {
-    if (RESERVED_ENV_NAMES.has(key))
-        return true;
-    const lower = key.toLowerCase();
-    return RESERVED_ENV_PREFIXES.some((p) => lower.startsWith(p));
-}
-/**
- * Collect only string→string entries from a raw `env` bag. A non-string value is dropped so a
- * malformed binding can't inject `[object Object]` (or undefined) as an upstream URL. Reserved
- * names that would break the toolchain or enable injection (PATH, NODE_OPTIONS, LD_PRELOAD, …) are
- * dropped too: they are spread over `process.env` at build time, so a binding named `PATH` would
- * replace it with a URL and the build would no longer find its tools. Extracted from the infra
- * parsers to keep their cyclomatic complexity down.
- */
-function parseInfraEnv(raw) {
-    const env = {};
-    if (typeof raw === 'object' && raw !== null) {
-        for (const [key, val] of Object.entries(raw)) {
-            if (key && !isReservedEnvName(key) && typeof val === 'string')
-                env[key] = val;
-        }
-    }
-    return env;
-}
 /** Parse the frontend UI-test infra spec (`kind: 'frontend'`), tolerating missing knobs. */
 function parseFrontendInfraSpec(o) {
     const packageManager = o.packageManager === 'pnpm' || o.packageManager === 'npm' || o.packageManager === 'yarn'
@@ -607,7 +519,8 @@ export function parseAgentJob(input) {
         packageRegistries: parsePackageRegistries(o.packageRegistries),
         skills: parseSkillSpecs(o.skills),
         mcpServers: parseMcpServerSpecs(o.mcpServers),
-        testSecrets: parseTestSecrets(o.testSecrets),
+        testSecrets: parseSecretEnvPairs(o.testSecrets, 'testSecrets'),
+        generatorSecrets: parseSecretEnvPairs(o.generatorSecrets, 'generatorSecrets'),
         guardLimits: parseGuardLimits(o.guardLimits),
         validation: parseValidationSpec(o.validation),
         validationChecks: parseValidationChecksSpec(o.validationChecks),
@@ -669,7 +582,7 @@ function parseAgentPrSpec(raw) {
  * literal doesn't blow the complexity budget; behaviour is byte-identical (spread order preserved).
  */
 function assembleAgentJob(o, mode, agentField, parts) {
-    const { output, pr, infra, peerRepos, referenceRepos, referenceBranches, bootstrap, contextFiles, packageRegistries, skills, mcpServers, testSecrets, guardLimits, validation, validationChecks, reproduction, dependencyInstall, reviewPrNumber, } = parts;
+    const { output, pr, infra, peerRepos, referenceRepos, referenceBranches, bootstrap, contextFiles, packageRegistries, skills, mcpServers, testSecrets, guardLimits, validation, validationChecks, reproduction, dependencyInstall, reviewPrNumber, generatorSecrets, } = parts;
     const repo = (o.repo ?? {});
     return {
         jobId: str(o.jobId, 'jobId'),
@@ -689,6 +602,7 @@ function assembleAgentJob(o, mode, agentField, parts) {
         ...(skills ? { skills } : {}),
         ...(mcpServers ? { mcpServers } : {}),
         ...(testSecrets.length ? { testSecrets } : {}),
+        ...(generatorSecrets.length ? { generatorSecrets } : {}),
         ...(infra ? { infra } : {}),
         ...(pr ? { pr } : {}),
         ...(peerRepos.length ? { peerRepos } : {}),

package/dist/progress-guard.d.ts

@@ -35,11 +35,38 @@ export interface ProgressGuardLimits {
      * without it.
      */
     maxConsecutiveWebCalls?: number;
+    /**
+     * Abort after this many consecutive MCP tool-server calls (`mcp__*`) with no other
+     * tool call in between: the tool-server analogue of `maxConsecutiveWebCalls`, and
+     * present for the same reason. An `mcp__*` call is exempt from the no-edit bound (see
+     * `isMcpToolCall`), so without a streak of its own a run could query a tool server
+     * indefinitely without tripping any guard. Any non-MCP tool call resets the streak.
+     * Optional: defaults to {@link DEFAULT_PROGRESS_GUARD_LIMITS}.
+     */
+    maxConsecutiveMcpCalls?: number;
+    /**
+     * Abort after this many consecutive calls that are EXEMPT from the no-edit bound
+     * (planning, read-only exploration, subagent dispatch, `mcp__*`) with no action call
+     * in between. The backstop that makes each individual exemption mean "not counted"
+     * rather than "unbounded": every per-family streak above resets on any call outside
+     * its own family, so a run alternating `web_search` with `mcp__issues__search` (or
+     * with `read`) trips none of them and, having never made an action call, never
+     * reaches `maxToolCallsWithoutEdit` either. Only the job's wall-clock ceiling
+     * bounded that.
+     *
+     * Deliberately far above every family cap, because it is not a research bound and
+     * must not become one: reading a hundred files before the first edit is legitimate
+     * work-up, and any `bash`/edit/action call resets the streak. Optional: defaults to
+     * {@link DEFAULT_PROGRESS_GUARD_LIMITS}.
+     */
+    maxConsecutiveNonActionCalls?: number;
 }
 export declare const DEFAULT_PROGRESS_GUARD_LIMITS: {
     maxToolCallsWithoutEdit: number;
     maxConsecutiveErrors: number;
     maxConsecutiveWebCalls: number;
+    maxConsecutiveMcpCalls: number;
+    maxConsecutiveNonActionCalls: number;
 };
 /** Read {@link ProgressGuardLimits} from the environment, falling back to the defaults. */
 export declare function progressGuardLimitsFromEnv(env?: NodeJS.ProcessEnv): ProgressGuardLimits;
@@ -69,6 +96,8 @@ export declare class ProgressGuard {
     private edits;
     private consecutiveErrors;
     private consecutiveWebCalls;
+    private consecutiveMcpCalls;
+    private consecutiveNonActionCalls;
     constructor(limits: ProgressGuardLimits, 
     /** When false (assess-only runs like the merger), the no-edit bound is skipped. */
     expectsEdits?: boolean);

package/dist/progress-guard.js

@@ -28,6 +28,16 @@ export const DEFAULT_PROGRESS_GUARD_LIMITS = {
     // A genuine research burst is a handful of searches; an uninterrupted run of this
     // many web calls (with no read/edit/bash between) is a search loop, not progress.
     maxConsecutiveWebCalls: 25,
+    // Looser than the web cap: a tool server is usually the agent's route to the SYSTEM OF
+    // RECORD (the issue tracker, the advisory database, the design source), and reading a
+    // list and then each of its items is a normal opening move, not a rabbit-hole. A run
+    // that makes this many in a row with no read, edit or bash between is looping.
+    maxConsecutiveMcpCalls: 40,
+    // Well clear of every family cap above, and of any plausible read-up: a run that makes
+    // this many exempt calls with not one action call between them has stopped converging,
+    // whatever mix of reads, searches and lookups it is cycling through. Sized as a
+    // backstop rather than a judgement, because the families are where judgement belongs.
+    maxConsecutiveNonActionCalls: 200,
 };
 // Tool names that mutate files, so a call to one clears the no-edit suspicion. Kept
 // broad on purpose: different models/extensions name the same capability differently
@@ -98,6 +108,28 @@ const EXPLORATION_TOOLS = new Set([
 // call between) can be caught as a search loop — see `maxConsecutiveWebCalls`. Covers both
 // Pi's `web_search`/`web_fetch` and Claude Code's `WebSearch`/`WebFetch`.
 const WEB_TOOLS = new Set(['web_search', 'web_fetch', 'websearch', 'webfetch']);
+// A call to a tool server (MCP). Every MCP client names these `mcp__<server>__<tool>`, and
+// the prefix is the ONLY thing the harness can know about them: what a given server's tools
+// do is a backend registration this image has never seen, so the guard classifies by shape.
+//
+// Matched, rather than enumerated in EXPLORATION_TOOLS, because the set is open: it is
+// whatever tool servers the running kind was wired with. A prefix test is also why this is a
+// function, `name.startsWith` on the already-lower-cased name, so `MCP__Issues__search`
+// classifies the same as `mcp__issues__search`.
+function isMcpToolCall(loweredName) {
+    return loweredName.startsWith('mcp__');
+}
+// Whether a call is EXEMPT from the no-edit bound: planning and bookkeeping, read-only
+// exploration, a subagent dispatch, or a tool-server call. One predicate rather than the
+// four tests inlined at the branch, because the combined non-action streak and the no-edit
+// exemption must be the SAME set: a family exempted in one place and missed in the other is
+// either an unbounded loop or a run killed for a call the bound says it may make.
+function isNonActionToolCall(loweredName) {
+    return (PLANNING_TOOLS.has(loweredName) ||
+        EXPLORATION_TOOLS.has(loweredName) ||
+        SUBAGENT_DISPATCH_TOOLS.has(loweredName) ||
+        isMcpToolCall(loweredName));
+}
 /** Read {@link ProgressGuardLimits} from the environment, falling back to the defaults. */
 export function progressGuardLimitsFromEnv(env = process.env) {
     const num = (raw, fallback) => {
@@ -108,6 +140,8 @@ export function progressGuardLimitsFromEnv(env = process.env) {
         maxToolCallsWithoutEdit: num(env.JOB_MAX_TOOLCALLS_WITHOUT_EDIT, DEFAULT_PROGRESS_GUARD_LIMITS.maxToolCallsWithoutEdit),
         maxConsecutiveErrors: num(env.JOB_MAX_CONSECUTIVE_TOOL_ERRORS, DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveErrors),
         maxConsecutiveWebCalls: num(env.JOB_MAX_CONSECUTIVE_WEB_CALLS, DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveWebCalls),
+        maxConsecutiveMcpCalls: num(env.JOB_MAX_CONSECUTIVE_MCP_CALLS, DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveMcpCalls),
+        maxConsecutiveNonActionCalls: num(env.JOB_MAX_CONSECUTIVE_NON_ACTION_CALLS, DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveNonActionCalls),
     };
 }
 /**
@@ -127,9 +161,12 @@ export function mergeGuardLimits(base, overrides) {
     return {
         maxToolCallsWithoutEdit: loosen(base.maxToolCallsWithoutEdit, overrides.maxToolCallsWithoutEdit),
         maxConsecutiveErrors: loosen(base.maxConsecutiveErrors, overrides.maxConsecutiveErrors),
-        // `maxConsecutiveWebCalls` is optional on the interface (callers may omit it), so
-        // fall back to the default before loosening — keeps `loosen`'s base a concrete number.
+        // The streak knobs are optional on the interface (callers may omit them), so fall back
+        // to the default before loosening: it keeps `loosen`'s base a concrete number.
         maxConsecutiveWebCalls: loosen(base.maxConsecutiveWebCalls ?? DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveWebCalls, overrides.maxConsecutiveWebCalls),
+        maxConsecutiveMcpCalls: loosen(base.maxConsecutiveMcpCalls ?? DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveMcpCalls, overrides.maxConsecutiveMcpCalls),
+        maxConsecutiveNonActionCalls: loosen(base.maxConsecutiveNonActionCalls ??
+            DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveNonActionCalls, overrides.maxConsecutiveNonActionCalls),
     };
 }
 /**
@@ -146,6 +183,8 @@ export class ProgressGuard {
     edits = 0;
     consecutiveErrors = 0;
     consecutiveWebCalls = 0;
+    consecutiveMcpCalls = 0;
+    consecutiveNonActionCalls = 0;
     constructor(limits, 
     /** When false (assess-only runs like the merger), the no-edit bound is skipped. */
     expectsEdits = true) {
@@ -189,14 +228,49 @@ export class ProgressGuard {
         else {
             this.consecutiveWebCalls = 0;
         }
-        // Planning, read-only exploration and subagent-dispatch calls don't count toward the
-        // no-edit bound (see PLANNING_TOOLS / EXPLORATION_TOOLS / SUBAGENT_DISPATCH_TOOLS) —
-        // only "action" calls without an edit do.
-        if (PLANNING_TOOLS.has(name) ||
-            EXPLORATION_TOOLS.has(name) ||
-            SUBAGENT_DISPATCH_TOOLS.has(name)) {
+        // Tool-server (MCP) calls: bounded as their own streak for exactly the reason the web
+        // streak exists. They are exempt from the no-edit bound below, and an exemption with no
+        // counter-bound is a loop the guard cannot see. Any non-MCP call resets it.
+        if (isMcpToolCall(name)) {
+            this.consecutiveMcpCalls++;
+            const mcpCap = this.limits.maxConsecutiveMcpCalls ?? DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveMcpCalls;
+            if (this.consecutiveMcpCalls >= mcpCap) {
+                return (`no progress: ${this.consecutiveMcpCalls} consecutive tool-server (MCP) calls without ` +
+                    `any other action. The agent is stuck querying its tools instead of doing the work. ` +
+                    `Aborting.`);
+            }
+        }
+        else {
+            this.consecutiveMcpCalls = 0;
+        }
+        // Planning, read-only exploration, subagent-dispatch and tool-server calls don't count
+        // toward the no-edit bound (see `isNonActionToolCall`): only "action" calls without an
+        // edit do.
+        //
+        // An `mcp__*` call is exempt for the same reason a `read` is: the bound targets the
+        // credential rabbit-hole (endless `bash` probing with nothing implemented), and reaching
+        // a registered tool server is the platform TELLING the agent to look something up
+        // ("prefer them over guessing"). Counting them would abort an edits-expected kind for
+        // consulting the issue tracker the deployment wired for it, punishing the run for
+        // following its own prompt. They are neutral rather than edit-satisfying, exactly like a
+        // subagent dispatch: a read-only lookup must not clear the suspicion the bound holds.
+        //
+        // The exempt calls carry ONE streak of their own, and it is what keeps every exemption
+        // above from adding up to an unbounded run: each per-family cap resets on any call
+        // outside its family, so alternating two exempt families trips neither, and a run that
+        // never makes an action call never reaches the no-edit bound either.
+        if (isNonActionToolCall(name)) {
+            this.consecutiveNonActionCalls++;
+            const nonActionCap = this.limits.maxConsecutiveNonActionCalls ??
+                DEFAULT_PROGRESS_GUARD_LIMITS.maxConsecutiveNonActionCalls;
+            if (this.consecutiveNonActionCalls >= nonActionCap) {
+                return (`no progress: ${this.consecutiveNonActionCalls} consecutive read-only calls (searching, ` +
+                    `reading, tool-server lookups, subagent dispatches) with no action call between them. ` +
+                    `The agent is cycling through research instead of doing the work. Aborting.`);
+            }
             return null;
         }
+        this.consecutiveNonActionCalls = 0;
         this.toolCalls++;
         if (FILE_EDIT_TOOLS.has(name))
             this.edits++;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/executor-harness",
-  "version": "1.86.2",
+  "version": "1.90.0",
   "description": "Container payload: a thin TypeScript wrapper that runs the Pi coding agent against a cloned repo and opens a PR. Runs in the Cloudflare Container (and, in local native mode, as a host process); carries no secrets.",
   "repository": {
     "type": "git",
@@ -30,9 +30,9 @@
     "hono": "^4.12.33",
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
-    "@cat-factory/kernel": "0.214.1",
-    "@cat-factory/server": "0.194.0",
-    "@cat-factory/spend": "0.13.1"
+    "@cat-factory/kernel": "0.232.0",
+    "@cat-factory/server": "0.210.0",
+    "@cat-factory/spend": "0.14.7"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/agent-capabilities.ts

@@ -178,6 +178,20 @@ function sanitizeServerId(value: unknown): string | undefined {
   return MCP_SERVER_ID_PATTERN.test(value) ? value : undefined
 }
 
+/**
+ * A tool name an `allowedTools` entry may name. Kept byte-identical to kernel's
+ * `MCP_TOOL_NAME_PATTERN` for the same reason {@link MCP_SERVER_ID_PATTERN} is a copy, and pinned
+ * against it by `test/agent-capabilities.conformity.test.ts`.
+ *
+ * The comma is the reason the rule exists on THIS side of the boundary too:
+ * {@link claudeAllowedToolPatterns} builds the list that the runner joins into one
+ * `--allowedTools` argument with commas, so an entry carrying one splits into two patterns of which
+ * the second matches no tool the CLI has. Dropped rather than passed through, because the entries
+ * that survive are what narrows the session: a bad one would silently take the run's whole MCP
+ * surface with it.
+ */
+export const MCP_TOOL_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/
+
 /**
  * Whether an HTTP tool server's URL may be started. Mirrors kernel's `isAllowedMcpHttpUrl` (see
  * {@link MCP_SERVER_ID_PATTERN} for why it is a copy, and the conformity suite that pins it):
@@ -219,13 +233,25 @@ function parseStringArray(value: unknown): string[] | undefined {
   return out.length ? out : undefined
 }
 
+/**
+ * The `allowedTools` list: string entries that are single tool NAMES (see
+ * {@link MCP_TOOL_NAME_PATTERN}). Undefined when nothing survives, which is the same answer as an
+ * absent field (every tool the server exposes) and the right one: the alternative is a list whose
+ * only surviving entries are the platform's own built-in tool names, i.e. a run narrowed to no MCP
+ * tools at all. The backend refuses these at registration; this is the boundary check.
+ */
+function parseAllowedTools(value: unknown): string[] | undefined {
+  const names = parseStringArray(value)?.filter((name) => MCP_TOOL_NAME_PATTERN.test(name))
+  return names?.length ? names : undefined
+}
+
 /** Validate one `mcpServers` entry, or undefined when malformed for its transport. */
 function parseMcpServerSpec(value: unknown): McpServerSpec | undefined {
   if (typeof value !== 'object' || value === null) return undefined
   const o = value as Record<string, unknown>
   const id = sanitizeServerId(o.id)
   if (!id) return undefined
-  const allowedTools = parseStringArray(o.allowedTools)
+  const allowedTools = parseAllowedTools(o.allowedTools)
   const secretKeys = parseStringArray(o.secretKeys)
   if (o.transport === 'http') {
     // https anywhere, plain http only on loopback: the CLI would happily be pointed at a
@@ -370,9 +396,13 @@ function tomlString(value: string): string {
 
 /**
  * The `[mcp_servers.<id>]` TOML block Codex reads from its `CODEX_HOME/config.toml`. Codex's MCP
- * client is stdio-only, so an `http` server is skipped here — the backend states such a server as
- * unavailable when it declares `harnesses: ['claude-code']`, and a deployment that wires an HTTP
- * server for Codex gets a no-op rather than a malformed config.
+ * client is stdio-only, so an `http` server is skipped here.
+ *
+ * The skip is now a BACKSTOP rather than the decision: the backend knows which transports each
+ * harness reaches (`MCP_HARNESS_TRANSPORTS`) and drops an `http` server from a Codex dispatch under
+ * its own `transport_unsupported` reason, so the prompt states the gap instead of advertising a tool
+ * this writer then silently omitted. It stays because a body that reached the container by any other
+ * route must still produce a valid config rather than a malformed one.
  */
 export function codexMcpConfigToml(servers: McpServerSpec[]): string {
   const blocks: string[] = []

package/src/agent.ts

@@ -330,7 +330,16 @@ export async function handleAgent(job: AgentJob, opts: RunOptions = {}): Promise
       job.packageRegistries,
       scopeDir ? { isolatedDir: scopeDir } : {},
     )
-    const scoped = withAgentEnv(opts, registryEnv)
+    // The credentials of this job's GENERATIVE BINARY INTEGRATIONS, layered on for EVERY mode
+    // rather than inside one of them: the kinds that carry the `binary-output` trait are a
+    // deployment's own and may be explore or coding agents, and a key delivered to one mode and
+    // not the other would be an integration that works or 401s depending on how its step was
+    // registered. Per-job env like everything else here — never `process.env`, which the shared
+    // native host process makes a cross-job leak.
+    const scoped = withAgentEnv(opts, {
+      ...registryEnv,
+      ...secretEnv(job.generatorSecrets),
+    })
     if (job.mode === 'preview') return await runPreviewMode(job, scoped)
     return job.mode === 'coding'
       ? await runCodingMode(job, scoped)
@@ -454,6 +463,16 @@ async function runPreviewMode(job: AgentJob, opts: RunOptions): Promise<AgentRes
  * the restore step entirely.
  */
 export function testSecretEnv(secrets: TestSecretSpec[] | undefined): Record<string, string> {
+  return secretEnv(secrets)
+}
+
+/**
+ * The shared `{ key, value }[]` → child-env projection behind {@link testSecretEnv} and the
+ * generative integrations' credentials. One implementation because both channels owe the same two
+ * things — the values registered for redaction, and the env returned rather than written to
+ * `process.env` — and a second copy is a second place to forget the redaction.
+ */
+export function secretEnv(secrets: TestSecretSpec[] | undefined): Record<string, string> {
   if (!secrets?.length) return {}
   registerKnownSecrets(secrets.map((s) => s.value))
   return Object.fromEntries(secrets.map(({ key, value }) => [key, value]))

package/src/job-env.ts

@@ -0,0 +1,121 @@
+// The primitive VALUE rules of the untrusted job body: what counts as a required string, which
+// environment-variable names a body may never set, and how the two env-bearing fields (the
+// tester's `testSecrets`, a generative integration's `generatorSecrets`, and a frontend binding's
+// `env`) are parsed against those rules.
+//
+// Extracted from `job.ts` when the generative-integration credentials arrived (the file-size
+// ratchet: split along a cohesive seam, never raise the budget). The seam is a real one — every
+// rule here answers "may this raw value become part of a child process's environment", which is
+// the harness's sharpest untrusted-input boundary, and it is now shared by three parsers rather
+// than being one parser's private business.
+
+/** A required non-empty string field of the job body. */
+export function str(value: unknown, path: string): string {
+  if (typeof value !== 'string' || value.length === 0) {
+    throw new Error(`Invalid job: '${path}' must be a non-empty string`)
+  }
+  return value
+}
+
+/**
+ * Env-var names never injected from a frontend binding: spread over `process.env` at build
+ * time, so any of these would break the toolchain (or enable code execution / cert overrides)
+ * rather than name an upstream URL. Matched exactly (Linux env is case-sensitive); the
+ * {@link RESERVED_ENV_PREFIXES} below cover whole families (`npm_config_*`, `GIT_*`, …).
+ */
+export const RESERVED_ENV_NAMES = new Set([
+  'PATH',
+  'HOME',
+  'NODE_OPTIONS',
+  'NODE_PATH',
+  'NODE_EXTRA_CA_CERTS',
+  'LD_PRELOAD',
+  'LD_LIBRARY_PATH',
+  'BASH_ENV',
+  'ENV',
+  'SHELL',
+  'IFS',
+])
+
+/**
+ * Env-var name PREFIXES never injected from a frontend binding. `npm_config_*` reconfigures the
+ * package manager (registry, scripts, prefix), and `GIT_*` reconfigures git — both run during a
+ * frontend install/build, so a binding in either family is toolchain control, not an upstream URL.
+ * Compared case-INSENSITIVELY (lower-cased here, matched lower-cased below): npm reads its config
+ * env with a case-insensitive `/^npm_config_/i`, so `NPM_CONFIG_REGISTRY` is honoured just like
+ * `npm_config_registry` — a case-sensitive prefix match would let the upper-cased form slip through.
+ */
+const RESERVED_ENV_PREFIXES = ['npm_config_', 'git_']
+
+/**
+ * Whether an env-var name is reserved (an exact name, or a reserved family prefix). The exact
+ * names are canonical upper-case env vars matched verbatim (Linux env is case-sensitive, so a
+ * distinct lower-cased `home` is a different, harmless var); the family PREFIXES are matched
+ * case-insensitively because npm interprets `npm_config_*` regardless of case (see above).
+ */
+export function isReservedEnvName(key: string): boolean {
+  if (RESERVED_ENV_NAMES.has(key)) return true
+  const lower = key.toLowerCase()
+  return RESERVED_ENV_PREFIXES.some((p) => lower.startsWith(p))
+}
+
+/**
+ * Collect only string→string entries from a raw `env` bag. A non-string value is dropped so a
+ * malformed binding can't inject `[object Object]` (or undefined) as an upstream URL. Reserved
+ * names that would break the toolchain or enable injection (PATH, NODE_OPTIONS, LD_PRELOAD, …) are
+ * dropped too: they are spread over `process.env` at build time, so a binding named `PATH` would
+ * replace it with a URL and the build would no longer find its tools. Extracted from the infra
+ * parsers to keep their cyclomatic complexity down.
+ */
+export function parseInfraEnv(raw: unknown): Record<string, string> {
+  const env: Record<string, string> = {}
+  if (typeof raw === 'object' && raw !== null) {
+    for (const [key, val] of Object.entries(raw as Record<string, unknown>)) {
+      if (key && !isReservedEnvName(key) && typeof val === 'string') env[key] = val
+    }
+  }
+  return env
+}
+
+/**
+ * One sensitive test credential the tester receives: an env-var name + its (secret) value.
+ * The backend seals these at rest and decrypts them at dispatch; the harness injects each as an
+ * environment variable the tester's shell can read (out of band — the value is NEVER in the
+ * prompt/telemetry). See {@link parseSecretEnvPairs}.
+ */
+export interface TestSecretSpec {
+  key: string
+  value: string
+}
+
+/** A valid POSIX shell variable name (letters, digits, underscore; not starting with a digit). */
+const ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/
+
+/**
+ * Validate a `{ key, value }` env-pair list under `field`. Shared by the tester's `testSecrets`
+ * and by `generatorSecrets` (the credentials of a step's generative binary integrations), because
+ * both are secret values the harness turns into environment variables of the agent's own process
+ * and both owe the same guarantees: valid env-var names, no toolchain-critical
+ * ({@link isReservedEnvName}) names, no duplicates. A second copy of these rules would be a second
+ * place for a drifted body to clobber PATH.
+ */
+export function parseSecretEnvPairs(value: unknown, field: string): TestSecretSpec[] {
+  if (value === undefined || value === null) return []
+  if (!Array.isArray(value)) throw new Error(`Invalid job: '${field}' must be an array`)
+  const entries: TestSecretSpec[] = []
+  const seen = new Set<string>()
+  for (const [i, raw] of value.entries()) {
+    if (typeof raw !== 'object' || raw === null) {
+      throw new Error(`Invalid job: '${field}[${i}]' must be an object`)
+    }
+    const entry = raw as Record<string, unknown>
+    const key = str(entry.key, `${field}[${i}].key`).trim()
+    if (!ENV_VAR_NAME_PATTERN.test(key)) {
+      throw new Error(`Invalid job: '${field}[${i}].key' must be a valid environment variable name`)
+    }
+    if (isReservedEnvName(key) || seen.has(key)) continue
+    seen.add(key)
+    entries.push({ key, value: str(entry.value, `${field}[${i}].value`) })
+  }
+  return entries
+}